<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of inria-00431666</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-19T07:14:18+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Dynamic Binary Instrumentation for Deobfuscation and Unpacking</title>
            <author role="aut">
              <persName>
                <forename type="first">Daniel</forename>
                <surname>Reynaud</surname>
              </persName>
              <email type="md5">dfc71068c801d24b0875adc2f1fdeb82</email>
              <email type="domain">loria.fr</email>
              <idno type="idhal" notation="numeric">854893</idno>
              <idno type="halauthorid" notation="string">357128-854893</idno>
              <affiliation ref="#struct-29797"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jean-Yves</forename>
                <surname>Marion</surname>
              </persName>
              <email type="md5">6773340d4dbea528bffc0b04a51eed2a</email>
              <email type="domain">LORIA.FR</email>
              <idno type="idhal" notation="string">jean-yves-marion</idno>
              <idno type="idhal" notation="numeric">12646</idno>
              <idno type="halauthorid" notation="string">2548208-12646</idno>
              <idno type="IDREF">https://www.idref.fr/075874849</idno>
              <idno type="ORCID">https://orcid.org/0009-0002-8262-3887</idno>
              <affiliation ref="#struct-29797"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Daniel</forename>
                <surname>Reynaud</surname>
              </persName>
              <email type="md5">dfc71068c801d24b0875adc2f1fdeb82</email>
              <email type="domain">loria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2009-11-12 17:15:30</date>
              <date type="whenModified">2025-11-04 12:00:56</date>
              <date type="whenReleased">2009-11-12 17:15:30</date>
              <date type="whenProduced">2009-11-19</date>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="132143">
                <persName>
                  <forename>Daniel</forename>
                  <surname>Reynaud</surname>
                </persName>
                <email type="md5">dfc71068c801d24b0875adc2f1fdeb82</email>
                <email type="domain">loria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">inria-00431666</idno>
            <idno type="halUri">https://inria.hal.science/inria-00431666</idno>
            <idno type="halBibtex">reynaud:inria-00431666</idno>
            <idno type="halRefHtml">&lt;i&gt;IN-DEPTH SECURITY CONFERENCE 2009 EUROPE&lt;/i&gt;, Nov 2009, Vienne, Austria</idno>
            <idno type="halRef">IN-DEPTH SECURITY CONFERENCE 2009 EUROPE, Nov 2009, Vienne, Austria</idno>
            <availability status="restricted"/>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INRIA">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="INRIA_TEST">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="LORIA2">Publications du LORIA</idno>
            <idno type="stamp" n="INRIA-NANCY-GRAND-EST">INRIA Nancy - Grand Est</idno>
            <idno type="stamp" n="TESTALAIN1">TESTALAIN1</idno>
            <idno type="stamp" n="UNIV-LORRAINE">Université de Lorraine</idno>
            <idno type="stamp" n="INRIA2">INRIA 2</idno>
            <idno type="stamp" n="LORIA">Laboratoire Lorrain de Recherche en Informatique et ses Applications</idno>
            <idno type="stamp" n="LORIA-FM" corresp="LORIA">Department of Formal methods</idno>
            <idno type="stamp" n="LHS">Laboratoire de Haute Sécurité - Inria Nancy</idno>
            <idno type="stamp" n="AM2I-UL">Pôle scientifique Automatique, Mathématiques, Informatique et leurs Intéractions de l'Université de Lorraine</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="0">No</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Dynamic Binary Instrumentation for Deobfuscation and Unpacking</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Daniel</forename>
                    <surname>Reynaud</surname>
                  </persName>
                  <email type="md5">dfc71068c801d24b0875adc2f1fdeb82</email>
                  <email type="domain">loria.fr</email>
                  <idno type="idhal" notation="numeric">854893</idno>
                  <idno type="halauthorid" notation="string">357128-854893</idno>
                  <affiliation ref="#struct-29797"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jean-Yves</forename>
                    <surname>Marion</surname>
                  </persName>
                  <email type="md5">6773340d4dbea528bffc0b04a51eed2a</email>
                  <email type="domain">LORIA.FR</email>
                  <idno type="idhal" notation="string">jean-yves-marion</idno>
                  <idno type="idhal" notation="numeric">12646</idno>
                  <idno type="halauthorid" notation="string">2548208-12646</idno>
                  <idno type="IDREF">https://www.idref.fr/075874849</idno>
                  <idno type="ORCID">https://orcid.org/0009-0002-8262-3887</idno>
                  <affiliation ref="#struct-29797"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>IN-DEPTH SECURITY CONFERENCE 2009 EUROPE</title>
                  <date type="start">2009-11-19</date>
                  <settlement>Vienne</settlement>
                  <country key="AT">Austria</country>
                </meeting>
                <imprint>
                  <date type="datePub">2009</date>
                </imprint>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info.info-cr">Computer Science [cs]/Cryptography and Security [cs.CR]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>We propose to extend the toolbox of reverse engineers beyond disassemblers, debuggers and emulators. Using dynamic binary instrumentation, it is very simple to write advanced tools such as automatic unpackers, system call tracers and deobfuscators. Based on our experiments, DBI is suitable for malware analysis. In this presentation, we will present a simple and accurate automatic unpacker integrated with IDA Pro and a Javascript deobfuscator, all written using DBI techniques.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-29797" status="OLD">
          <idno type="RNSR">200918992J</idno>
          <orgName>Theoretical adverse computations, and safety</orgName>
          <orgName type="acronym">CARTE</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/equipes/carte</ref>
          </desc>
          <listRelation>
            <relation active="#struct-129671" type="direct"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-423084" type="direct"/>
            <relation active="#struct-206040" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation active="#struct-413289" type="indirect"/>
            <relation name="UMR7503" active="#struct-441569" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-129671" status="VALID">
          <idno type="RNSR">198618246Y</idno>
          <idno type="ROR">https://ror.org/03fcjvn64</idno>
          <orgName>Centre Inria de l'Université de Lorraine</orgName>
          <desc>
            <address>
              <addrLine>615 rue du Jardin Botanique 54600 Villers-lès-Nancy</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/nancy</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-423084" status="VALID">
          <orgName>Department of Formal Methods</orgName>
          <orgName type="acronym">LORIA - FM</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.loria.fr/en/research/departments/formal-methods/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-206040" type="direct"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation active="#struct-413289" type="indirect"/>
            <relation name="UMR7503" active="#struct-441569" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-206040" status="VALID">
          <idno type="IdRef">067077927</idno>
          <idno type="ISNI">0000000121795429</idno>
          <idno type="RNSR">198912571S</idno>
          <idno type="IdUnivLorraine">[UL]RSI--</idno>
          <idno type="ROR">https://ror.org/02vnf0c38</idno>
          <orgName>Laboratoire Lorrain de Recherche en Informatique et ses Applications</orgName>
          <orgName type="acronym">LORIA</orgName>
          <date type="start">2012-01-01</date>
          <desc>
            <address>
              <addrLine>Campus Scientifique BP 239 54506 Vandoeuvre-lès-Nancy Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.loria.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
            <relation active="#struct-411575" type="direct"/>
            <relation active="#struct-413289" type="direct"/>
            <relation name="UMR7503" active="#struct-441569" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-411575" status="VALID">
          <idno type="IdRef">184443237</idno>
          <idno type="ROR">https://ror.org/019tcpt25</idno>
          <orgName>CentraleSupélec</orgName>
          <desc>
            <address>
              <addrLine>3, rue Joliot Curie,Plateau de Moulon,91192 GIF-SUR-YVETTE Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.centralesupelec.fr</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-413289" status="VALID">
          <idno type="IdRef">157040569</idno>
          <idno type="IdUnivLorraine">[UL]100--</idno>
          <idno type="ROR">https://ror.org/04vfs2w97</idno>
          <orgName>Université de Lorraine</orgName>
          <orgName type="acronym">UL</orgName>
          <date type="start">2012-01-01</date>
          <desc>
            <address>
              <addrLine>34 cours Léopold - CS 25233 - 54052 Nancy cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-lorraine.fr/</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>