Skip to main navigation Skip to search Skip to main content

VMRe: A reverse framework of virtual machine protection packed binaries

  • Jie Lin
  • , Chuanyi Liu*
  • , Xinyi Zhang
  • , Rongfei Zhuang
  • , Binxing Fang
  • *Corresponding author for this work
  • Harbin Institute of Technology Shenzhen
  • The Chinese University of Hong Kong, Shenzhen
  • China Academy of Engineering Physics

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Virtual machine protection is an advanced anti-reverse packing technology. This paper presents a framework for automatic analysis of binary packed by virtual machine protection software. Using multi-granularity dynamic instrumentation to trace binary can effectively record instruction execution and value changes in memory and register. Symbol execution is used to simplify assembly instructions and filter invalid instructions. The experimental results show that the method presented in this paper can effectively assist reverse engineers in the analysis of packed program by virtual machine protection.

Original languageEnglish
Title of host publicationProceedings - 2019 IEEE 4th International Conference on Data Science in Cyberspace, DSC 2019
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages528-535
Number of pages8
ISBN (Electronic)9781728145280
DOIs
StatePublished - Jun 2019
Externally publishedYes
Event4th IEEE International Conference on Data Science in Cyberspace, DSC 2019 - Hangzhou, China
Duration: 23 Jun 201925 Jun 2019

Publication series

NameProceedings - 2019 IEEE 4th International Conference on Data Science in Cyberspace, DSC 2019

Conference

Conference4th IEEE International Conference on Data Science in Cyberspace, DSC 2019
Country/TerritoryChina
CityHangzhou
Period23/06/1925/06/19

Keywords

  • Instrumentation
  • Packing
  • Reverse engineering
  • Symbolic execution
  • Virtual machine Protection

Fingerprint

Dive into the research topics of 'VMRe: A reverse framework of virtual machine protection packed binaries'. Together they form a unique fingerprint.

Cite this