Automated Unpacking & Deobfuscation of Nested VM-Based Protectors
Presents a dynamic analysis framework for automatically unpacking and deobfuscating nested virtual-machine-based software protectors used in advanced malware.
Summary
Virtual-Machine-Based Code Obfuscation
VM-based protectors (such as VMProtect and custom malware hypervisors) translate native CPU instructions into proprietary virtual bytecode executed by an embedded interpreter, confounding traditional static decompilers.
Challenges of Nested Virtualization
Advanced malware authors layer multiple virtual machines inside one another, creating nested interpreter loops that thwart manual reverse engineering and trace analysis.
Automated Symbolic Execution and De-Virtualization
Agostino Panico introduces an automated analysis framework utilizing dynamic binary instrumentation (DBI) and symbolic execution to trace VM execution loops, isolate bytecode handlers, and reconstruct native assembly.
Accelerating Malware Triage and Analysis
Automating the de-virtualization of nested VM protectors significantly reduces the time required for malware analysts and reverse engineers to analyze sophisticated threat payloads.
Related talks
Main Stage·21 min
Patrick Wardle
Patrick Wardle presents specialized reverse engineering techniques and tooling to automatically extract obfuscated AppleScript and shell payloads from macOS malware.
Main Stage·48 min
Alexandre Borges
Deep-dives into .NET CLR internals to equip analysts with techniques for reversing obfuscated .NET malware families.
Main Stage·42 min
Laurie Kirk
Laurie Kirk unveils runtime manipulation techniques in native C++ via JNI to alter Android execution flow, defeating emulators and decompilers.