HAL will be down for maintenance from Friday, June 10 at 4pm through Monday, June 13 at 9am. More information
Skip to Main content Skip to Navigation

Analyse de codes auto-modifiants pour la sécurité logicielle

Abstract : Self-modifying programs run in a very specific way: they are capable to rewrite their own code at runtime. Remarkably absent from theoretical computation models, they are present in every modern computer and operating system. Indeed, they are used by bootloaders, for just-in-time compilation or dynamic optimizations. They are also massively used by malware authors in order to bypass antivirus signatures and to delay analysis. Finally, they are unintentionally present in every program, since we can model code injection vulnerabilities (such as buffer overflows) as the ability for a program to accidentally execute data.In this thesis, we propose a formal framework in order to characterize advanced self-modifying behaviors and code armoring techniques. A prototype, TraceSurfer, allows us to detect these behaviors by using fine-grained execution traces and to visualize them as self-reference graphs. Finally, we assess the performance and efficiency of the tool by running it on a large corpus of malware samples
Complete list of metadata

Cited literature [46 references]  Display  Hide  Download

Contributor : Thèses Ul Connect in order to contact the contributor
Submitted on : Thursday, March 29, 2018 - 11:52:56 AM
Last modification on : Saturday, October 16, 2021 - 11:26:08 AM
Long-term archiving on: : Friday, September 14, 2018 - 7:43:11 AM


Files produced by the author(s)


  • HAL Id : tel-01748918, version 1



Daniel Reynaud. Analyse de codes auto-modifiants pour la sécurité logicielle. Autre. Institut National Polytechnique de Lorraine, 2010. Français. ⟨NNT : 2010INPL049N⟩. ⟨tel-01748918⟩



Record views


Files downloads