@inproceedings{ee5b4b6549a44d5c8f3ba2dc0fd50d77,
title = "Deobfuscation of virtualization-obfuscated code through symbolic execution and compilation optimization",
abstract = "Virtualization-obfuscation replaces native code in a binary with semantically equivalent and self-defined bytecode, which, upon execution, is interpreted by a custom virtual machine. It makes the code very difficult to analyze and is thus widely used in malware. How to deobfuscate such virtualization obfuscated code has been an important and challenging problem. We approach the problem from an innovative perspective by transforming it into a compilation optimization problem, and propose a novel technique that combines trace analysis, symbolic execution and compilation optimization to defeat virtualization obfuscation. We implement a prototype system and evaluate it against popular virtualization obfuscators; the results demonstrate that our method is effective in deobfuscation of virtualization-obfuscated code.",
keywords = "Compilation optimization, Deobfuscation, Symbolic execution, Virtualization obfuscation",
author = "Mingyue Liang and Zhoujun Li and Qiang Zeng and Zhejun Fang",
note = "Publisher Copyright: {\textcopyright} Springer International Publishing AG, part of Springer Nature 2018.; 19th International Conference on Information and Communications Security, ICICS 2017 ; Conference date: 06-12-2017 Through 08-12-2017",
year = "2018",
doi = "10.1007/978-3-319-89500-0\_28",
language = "英语",
isbn = "9783319894997",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
publisher = "Springer Verlag",
pages = "313--324",
editor = "Sihan Qing and Dongmei Liu and Chris Mitchell and Liqun Chen",
booktitle = "Information and Communications Security - 19th International Conference, ICICS 2017, Proceedings",
address = "德国",
}