Keynote SSTIC 2009 – Automatic deobfuscation of binaries

Presentation : Alexandre GAZET, Yoann GUILLOT

Malware is often obfuscated using "packers" or embedded virtual machines, or both!

In the proposed solution, the code of the offending binary is analyzed, then simplified (optimized); that is the binding (translate the code into pseudo-language). This eliminates many unnecessary operations (used to conceal illicit behavior).
Next, the pseudo-code is executed by the product, which will create the assembler code on the fly for each requested operation and compile it. in ia32.

The ia32 code thus generated can now be analyzed, regardless of the initial protection, or even decompiled to obtain higher-level code.

Future of this research Automatic decompilation, being further from the target architecture, providing higher-level code.
However, it's not the easiest task, especially for processor instructions that have no equivalent in higher-level languages (like C). A lot of work remains to be done to make the solution fully usable.