检索结果-内蒙古大学图书馆

Measurement of anti-debugging Techniques on the Windows and Linux Operating Systems for the Intel x86_64 Architecture

引用

IEEE ACCESS 2025年 13卷 46568-46583页

作者： Norby, Austin Rimal, Bhaskar P. Brizendine, Bramwell Bogart Associates Northern Virginia Reston VA 20190 USA Univ Idaho Dept Comp Sci Moscow ID 83844 USA Univ Alabama Dept Comp Sci Huntsville AL 35899 USA

Malware authors and software protection frameworks often use anti-debugging techniques to hinder understanding of the underlying code. Companies use anti-debugging techniques to prevent intellectual property, including music, movies, and games, from being stolen or abused by malicious actors. In addition, the encryption of program data or private data can also be classified as an anti-debugging technique because it requires additional effort to reverse engineer or debug it. Malware authors also use these techniques to prevent their software from being analyzed, detected, or blocked. While anti-debugging techniques are not novel, there is minimal research on their performance. This paper conducted novel research on commonly used anti-debugging techniques by measuring their performance on both the Windows and Linux operating system while also creating performance data about the most common anti-debugging techniques, including implementations and statistical measures for six categories of anti-debugging techniques. The statistical results describe a low overhead for the API tests, timing tests, and debug register tests. As expected, the memory encryption test had the highest overhead. Lastly, the paper discusses these results and their statistics per technique and includes code samples for future research.

关键词： Codes Malware Linux debugging Kernel Virtual machine monitors Encryption Timing Registers Data visualization anti-debugging code obfuscation debugger malware analysis memory encryption OpenSSL

来源：评论

学校读者我要写书评

暂无评论

anti-debugging scheme for protecting mobile apps on android platform

引用

JOURNAL OF SUPERCOMPUTING 2016年第1期72卷 232-246页

作者： Cho, Haehyun Lim, Jongsu Kim, Hyunki Yi, Jeong Hyun Soongsil Univ Sch Comp Sci & Engn Seoul 156743 South Korea

The Android application package file, APK file, can be easily decompiled using Android reverse engineering tools. Thus, general apps can be easily transformed into malicious application through reverse engineering and analysis. These repacked apps could be uploaded in general android app market called Google Play Store and redistributed. To prevent theses malicious behaviors such as malicious code injection or code falsifications, many techniques and tools were developed. However, these techniques also can be analyzed using debuggers. Also, analyzed apps can be tampered easily. For example, when applying anti-analysis techniques to android apps using Dexprotector which is commercial tool for protecting android app, it can be seen that these techniques can also be analyzed using debugger. In this paper, to protect the android app from the attack using debugger, we propose anti-debugging techniques for native code debugging and managed code debugging of android apps.

关键词： anti-reversing Android APP protection Detecting emulator anti-debugging

来源：评论

学校读者我要写书评

暂无评论

anti-debugging Framework Based on Hardware Virtualization Technology

Anti-debugging Framework Based on Hardware Virtualization Te...

引用

International Conference on Research Challenges in Computer Science

作者： Yi, Tengfei Zong, Aijun Yu, Miao Gao, Shang Lin, Qian Yu, Peijie Ren, Zhong Qi, Zhengwei Shanghai Jiao Tong Univ Sch Software Shanghai 200030 Peoples R China

ISBN: (纸本)9780769539270

anti-debugging technique is widely used to protect executable files in commercial software applications. However, most of contemporary anti-debugging products fail to guarantee their functionalities in that when the application code is running on Ring 0 or above, malicious attackers can still manipulate it to block the anti-debugging process. This paper introduces an anti-debugging framework based on hardware virtualization technology called Virtual Machine Monitor (VMM), which can monitor each code running above its privilege level on Intel x86 platform. Our experiments demonstrate that major debuggers running on Microsoft Windows, such as VC2005 and WinDBG, are incapable to debug the target application with the protection of our anti-debugging framework.

关键词： hardware virtualization anti-debugging VMM

来源：评论

学校读者我要写书评

暂无评论

Resurrecting anti-virtualization and anti-debugging: Unhooking your hooks

引用

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE 2021年 116卷 393-405页

作者： Apostolopoulos, Theodoros Katos, Vasilios Choo, Kim-Kwang Raymond Patsakis, Constantinos Univ Piraeus 80 Karaoli & Dimitriou Str Piraeus 18534 Greece Bournemouth Univ Poole House P323Talbot Campus Poole BH12 5BB Dorset England Univ Texas San Antonio 1 UTSA Cir San Antonio TX 78249 USA Athena Res Ctr Artemidos 6 Maroussi 15125 Greece

Dynamic malware analysis involves the debugging of the associated binary files and the monitoring of changes in sandboxed environments. This allows the investigator to manipulate the code execution path and environment to develop an understanding of the malware's internal workings, aims and modus operandi. However, the malware may incorporate anti-virtual environment (VM) and anti debugging countermeasures (e.g. determining whether the malware is being executed in a VM, or using a debugger prior to payload execution). In essence, the malware needs to adopt a "defence in depth"paradigm. Beyond the malicious uses, software vendors seeking to preserve the intellectual property rights of their products often resort to similar methods to deter competitors from gaining intelligence from the binaries or prevent customers from using their products without unauthorization. In this work, we illustrate how the Windows architecture impedes the work of debuggers in the analysis of armoured binaries. The debugger and the malware have the same privileges, so the attacker may manipulate the address space that the debugger operates to bypass detection. We showcase this by presenting a new framework (anti), which automates the procedure of integrating anti-debugging and anti-VM in the binary. Specifically, anti introduces an anti-hooking method targeting Windows binaries, where hooks applied by state of the art debuggers are removed and injects its code in other processes. This significantly compounds the challenge of binary analysis. Our extensive evaluation also demonstrates that anti successfully circumvents detection from state-of-the-art detection methods. In other words, we show using anti that implementation gaps in current tools for dynamic analysis can be exploited to allow binaries to bypass them. More concerningly, anti shows how one can use well-known methods to "resurrect"old attacks. (c) 2020 Elsevier B.V. All rights reserved.

关键词： Malware Windows hooking Dynamic analysis anti-debugging anti-virtualization

来源：评论

学校读者我要写书评

暂无评论

REDIR: Automated Static Detection of Obfuscated anti-debugging Techniques

REDIR: Automated Static Detection of Obfuscated Anti-Debuggi...

引用

International Conference on Collaboration Technologies and Systems (CTS)

作者： Smith, Adam J. Mills, Robert F. Bryant, Adam R. Peterson, Gilbert L. Grimaila, Michael R. US Air Force Inst Technol Ctr Cyberspace Res Wright Patterson AFB OH 45433 USA Cyber Res Lab Riverside Res Beavercreek OH 45431 USA

ISBN: (纸本)9781479951581

Reverse Code Engineering (RCE) to detect anti-debugging techniques in software is a very difficult task. Code obfuscation is an anti-debugging technique makes detection even more challenging. The Rule Engine Detection by Intermediate Representation (REDIR) system for automated static detection of obfuscated anti-debugging techniques is a prototype designed to help the RCE analyst improve performance through this tedious task. Three tenets form the REDIR foundation. First, Intermediate Representation (IR) improves the analyzability of binary programs by reducing a large instruction set down to a handful of semantically equivalent statements. Next, an Expert System (ES) rule-engine searches the IR and initiates a sense-making process for anti-debugging technique detection. Finally, an IR analysis process confirms the presence of an anti-debug technique. The REDIR system is implemented as a debugger plug-in. Within the debugger, REDIR interacts with a program in the disassembly view. Debugger users can instantly highlight anti-debugging techniques and determine if the presence of a debugger will cause a program to take a conditional jump or fall through to the next instruction.

关键词： Reverse code engineering Expert systems Sensemaking anti-debugging

来源：评论

学校读者我要写书评

暂无评论

A Dynamic App anti-debugging Approach on Android ART Runtime 16

A Dynamic App Anti-Debugging Approach on Android ART Runtime

引用

16th IEEE Int Conf on Dependable, Autonom and Secure Comp/16th IEEE Int Conf on Pervas Intelligence and Comp/4th IEEE Int Conf on Big Data Intelligence and Comp/3rd IEEE Cyber Sci and Technol Congress (DASC/PiCom/DataCom/CyberSciTech)

作者： Wan, Jia Zulkernine, Mohammad Liem, Clifford Queens Univ Sch Comp Kingston ON Canada Irdeto Corp Ottawa ON Canada

ISBN: (纸本)9781538675182

App anti-debugging techniques can protect app behavior from being leaked to attackers, thus reducing the possibilities of being compromised. Apps are vulnerable to being debugged in an insecure Android environment such as an emulator or a device with a rooted Android ROM. Researchers have proposed various Android Runtime (ART) instrumentation toolkits to trace app behavior. However, little research has been done to protect apps from being traced by those toolkits. In this paper, we introduce an approach to help apps combat being debugged dynamically. We collect potential check points and verify their integrity to protect them from being tampered with. We implement the approach and present the evaluation results on Android 8. The results show that the anti-debugging approach can defeat the tracking of app behavior effectively and efficiently.

关键词： App protection anti-debugging Android Runtime Dynamic analysis ART

来源：评论

学校读者我要写书评

暂无评论

Thwarting Piracy: anti-debugging Using GPU-assisted Self-healing Codes 15

Thwarting Piracy: Anti-debugging Using GPU-assisted Self-hea...

引用

15th International Conference on Communication Systems and Networks (COMSNETS)

作者： Mishra, Adhokshaj Hanawal, Manjesh K. Uptycs India Pvt Ltd Bengaluru India Indian Inst Technol IEOR MLiONS Lab Mumbai Maharashtra India

ISBN: (纸本)9781665477062

Software piracy is one of the concerns in the IT sector. Pirates leverage the debugger tools to reverse engineer the logic that verifies the license keys or bypass the entire verification process. anti-debugging techniques are used to defeat piracy using self-healing codes. However, anti-debugging methods can be defeated when the licensing protections are limited to CPUbased implementation by writing custom codes to deactivate the anti-debugging methods. In the paper, we demonstrate how GPU implementation can prevent pirates from deactivating the antidebugging methods by using the limitations of debugging on GPU. Generally, GPUs do not support debugging directly on the hardware, and therefore all the debugging is limited to CPUbased emulation. Also, a process running on CPU generally does not have any visibility on codes running on GPU, which comes as an added benefit for our work. We provide an implementation on GPU to show the feasibility of our method. As GPUs are getting widespread with the raise in popularity of gaming software, our technique provides a method to protect against piracy. Our method thwarts any attempts to bypass the license verification step thus offering a better anti-piracy mechanism.

关键词： Cyber security anti piracy anti-debugging GPU-assisted Self-healing

来源：评论

学校读者我要写书评

暂无评论

debugging Classification and anti-debugging Strategies

Debugging Classification and Anti-Debugging Strategies

引用

4th International Conference on Machine Vision (ICMV) - Computer Vision and Image Analysis - Pattern Recognition and Basic Technologies

作者： Gao, Shang Lin, Qian Xia, Mingyuan Yu, Miao Qi, Zhengwei Guan, Haibing Shanghai Jiao Tong Univ Shanghai 200030 Peoples R China

ISBN: (纸本)9780819490261

debugging, albeit useful for software development, is also a double-edge sword since it could also be exploited by malicious attackers. This paper analyzes the prevailing debuggers and classifies them into 4 categories based on the debugging mechanism. Furthermore, as an opposite, we list 13 typical anti-debugging strategies adopted in Windows. These methods intercept specific execution points which expose the diagnostic behavior of debuggers.

关键词： debugging anti-debugging software protection

来源：评论

学校读者我要写书评

暂无评论

Disabling anti-debugging Techniques for Unpacking System in User-level Debugger 10

Disabling Anti-Debugging Techniques for Unpacking System in ...

引用

10th International Conference on Information and Communication Technology Convergence (ICTC) - ICT Convergence Leading the Autonomous Future

作者： Kim, Jong-Wouk Bang, Jiwon Moon, Yang-Sae Choi, Mi-Jung Kangwon Natl Univ Dept Comp Sci Gangwon Do South Korea

ISBN: (纸本)9781728108933

E-mail attacks and spear phishing attacks, which have been pretended as corporations and civil servants, are occurring frequently. Phishing is used to steal user's personal or financial information by redirecting users to web-sites hosted with malicious code. Malware is becoming more and more intelligent as it combines with social engineering techniques, causing damage to companies, organization, or users through e-mail or web sites. Attackers who create malware use a variety of techniques, such as disrupting and delaying analysis to increase malware's life time. anti-debugging techniques interferes with malware analysis and make it more difficult to analysis. We introduce five functions and one data structure that malware uses for anti-debugging techniques. We propose and verify a method for disabling anti-debugging techniques for such malware which have been protected by packing and anti-debugging techniques in user level debugger. This can be expected to make it easier for malware analysts to analyze malware that includes antidebugging techniques.

关键词： malware anti-debugging anti-anti-debugging packing portable executable file

来源：评论

学校读者我要写书评

暂无评论

Malware Detection Method Focusing on anti-debugging Functions 2

Malware Detection Method Focusing on Anti-Debugging Function...

引用

International Symposium on Computing and Networking CANDAR

作者： Yoshizaki, Kota Yamauchi, Toshihiro Okayama Univ Grad Sch Nat Sci & Technol Kita Ku 3-1-1 Tsushima Naka Okayama 7008530 Japan

ISBN: (纸本)9781479941520

Malware has received much attention in recent years. antivirus software is widely used as a countermeasure against malware. However, some kinds of malware can evade detection by antivirus software;hence, a new detection method is required. In this paper, we propose a malware detection method that focuses on anti-debugging functions. An anti-debugging function is a method that prevents malware analysts from analyzing an application program (AP). The function can form part of benign as well as malicious APs. Our method focuses on a behavioral difference between benign and malicious APs and detects malware by comparing the two behavioral patterns. Evaluation results with malware confirmed our method to be capable of successfully detecting malware.

关键词： security malware detection anti-debugging

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：