Analyse de codes auto-modifiants pour la sécurité logicielle

Abstract : Self-modifying programs run in a very specific way: they are capable to rewrite their own code at runtime. Remarkably absent from theoretical computation models, they are present in every modern computer and operating system. Indeed, they are used by bootloaders, for just-in-time compilation or dynamic optimizations. They are also massively used by malware authors in order to bypass antivirus signatures and to delay analysis. Finally, they are unintentionally present in every program, since we can model code injection vulnerabilities (such as buffer overflows) as the ability for a program to accidentally execute data.In this thesis, we propose a formal framework in order to characterize advanced self-modifying behaviors and code armoring techniques. A prototype, TraceSurfer, allows us to detect these behaviors by using fine-grained execution traces and to visualize them as self-reference graphs. Finally, we assess the performance and efficiency of the tool by running it on a large corpus of malware samples
Complete list of metadatas

Cited literature [46 references]  Display  Hide  Download

https://hal.univ-lorraine.fr/tel-01748918
Contributor : Thèses Ul <>
Submitted on : Thursday, March 29, 2018 - 11:52:56 AM
Last modification on : Tuesday, April 24, 2018 - 1:30:58 PM
Long-term archiving on: Friday, September 14, 2018 - 7:43:11 AM

File

2010_REYNAUD_D.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : tel-01748918, version 1

Collections

Citation

Daniel Reynaud. Analyse de codes auto-modifiants pour la sécurité logicielle. Autre. Institut National Polytechnique de Lorraine, 2010. Français. ⟨NNT : 2010INPL049N⟩. ⟨tel-01748918⟩

Share

Metrics

Record views

85

Files downloads

61