SHF: Small: Reverse Engineering Obfuscated Executables

计算机恶意软件代码通常通过各种技术严重混淆，使得难以理解代码的逻辑。 用于恶意软件分析的现有工具不提供对自动移除此类混淆的太多支持，因此这需要大量耗时的手动干预。该项目旨在开发技术和工具，以自动识别和删除恶意软件程序中的混淆代码，特别关注一类称为“基于虚拟化的混淆”的混淆。 它使用程序分析技术来识别影响程序的可观察行为的指令;这些指令被提取，并在适当的情况下被简化以获得去混淆的恶意软件代码。该项目的主要影响将是使安全研究人员更容易和更快地找出恶意软件程序的内部逻辑。 反过来，这将使我们能够更快地响应新的恶意软件，并更快地开发对策，减少人工干预。 其效果将是在恶意软件被中和之前减少它们所造成的损害。

Computer malware codes are usually heavily obfuscated via a variety of techniques that make it difficult to understand the logic of the code. Existing tools for malware analysis do not provide much support for automatically removing such obfuscations, which therefore requires a great deal of time-consuming manual intervention. This project aims to develop techniques and tools to automate the identification and removal of obfuscation code from malware programs, focusing in particular on a class of obfuscations called "virtualization-based obfuscation". It uses program analysis techniques to identify instructions that affect the program's observable behavior; these instructions are extracted and, where appropriate, simplified to obtain the deobfuscated malware code. The main impact of this project will be to make it easier and quicker for security researchers to figure out the internal logic of malware programs. This, in turn, will make it possible to respond more quickly to new malware and develop countermeasures to them faster and with less manual intervention. The effect will be to reduce the damage done by malware before they can be neutralized.