Dynamic Binary Instrumentation for Deobfuscation and Unpacking
Résumé
We propose to extend the toolbox of reverse engineers beyond disassemblers, debuggers and emulators. Using dynamic binary instrumentation, it is very simple to write advanced tools such as automatic unpackers, system call tracers and deobfuscators. Based on our experiments, DBI is suitable for malware analysis. In this presentation, we will present a simple and accurate automatic unpacker integrated with IDA Pro and a Javascript deobfuscator, all written using DBI techniques.