Detail publikace

Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis

ĎURFINA, L. KŘOUSTEK, J. ZEMEK, P. KOLÁŘ, D. HRUŠKA, T. MASAŘÍK, K. MEDUNA, A.

Originální název

Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis

Typ

článek ve sborníku mimo WoS a Scopus

Jazyk

angličtina

Originální abstrakt

Together with the massive expansion of smartphones, tablets, and other smart devices, we can notice a growing number of malware threats targeting these platforms. Software security companies are not prepared for such diversity of target platforms and there are only few techniques for platform-independent malware analysis. This is a major security issue these days. In this paper, we propose a concept of a retargetable reverse compiler (i.e. a decompiler), which is in an early stage of development. The retargetable decompiler transforms platform-specific binary applications into a high-level language (HLL) representation, which can be further analyzed in a uniform way. This tool will help with a static platform-independent malware analysis. Our unique solution is based on an exploitation of two systems that were originally not intended for such an application - the architecture description language (ADL) ISAC for a platform description and the LLVM Compiler System as the core of the decompiler. In this study, we show that our tool can produce highly readable HLL code.

Klíčová slova

decompilation, reverse engineering, malware, LLVM, Lissom, ISAC

Autoři

ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KOLÁŘ, D.; HRUŠKA, T.; MASAŘÍK, K.; MEDUNA, A.

Rok RIV

2011

Vydáno

15. 8. 2011

Nakladatel

Springer Verlag

Místo

Brno

ISBN

978-3-642-23140-7

Kniha

The 5th International Conference on Information Security and Assurance

Edice

Communications in Computer and Information Science, Volume 200

Strany od

72

Strany do

86

Strany počet

15

URL

http://link.springer.com/chapter/10.1007%2F978-3-642-23141-4_8

BibTex

@inproceedings{BUT76329,
  author="Lukáš {Ďurfina} and Jakub {Křoustek} and Petr {Zemek} and Dušan {Kolář} and Tomáš {Hruška} and Karel {Masařík} and Alexandr {Meduna}",
  title="Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis",
  booktitle="The 5th International Conference on Information Security and Assurance",
  year="2011",
  series="Communications in Computer and Information Science, Volume 200",
  pages="72--86",
  publisher="Springer Verlag",
  address="Brno",
  doi="10.1007/978-3-642-23141-4\{_}8",
  isbn="978-3-642-23140-7",
  url="http://link.springer.com/chapter/10.1007%2F978-3-642-23141-4_8"
}