Lost in the Loader:The Many Faces of the Windows PE File Format - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Lost in the Loader:The Many Faces of the Windows PE File Format

Dario Nisi
  • Fonction : Auteur
  • PersonId : 1392064
Mariano Graziano
  • Fonction : Auteur
Yanick Fratantonio
  • Fonction : Auteur
Davide Balzarotti

Résumé

A known problem in the security industry is that programs that deal with executable file formats, such as OS loaders, reverseengineering tools, and antivirus software, often have little discrepancies in the way they interpret an input file. These differences can be abused by attackers to evade detection or complicate reverse engineering, and are often found by researchers through a manual, trial-and-error process. In this paper, we present the first systematic analysis and exploration of PE parsers. To this end, we developed a framework to easily capture the details on how different software parses, checks, and validates whether a file is compliant with a set of specifications. We then used this framework to create models for the loaders of three versions of Windows (XP, 7, and 10) and for several reverseengineering and antivirus tools. Finally, we used this framework to automatically compare different models, generate new samples from a model, or validate an executable according to a chosen model. Our system also supports more complex tasks, such as “generating samples that would load on Windows 10 but not on Windows 7.” The results of our analysis have consequences on several aspects of system security. We show that popular analysis tools can be completely bypassed, that the information extracted by these analysis tools can be easily manipulated, and that it is trivial for malware authors to fingerprint and “target” only specific versions of an operating system in ways that are not obvious to someone analyzing the executable. But, more importantly, we show that there is not one correct way to parse PE files, and therefore that it is not sufficient for security tools to fix the many inconsistencies we found in our experiments. Instead, to tackle the problem at its roots, tools should allow the analyst to select which of the several loader models they should emulate.
Fichier principal
Vignette du fichier
publi-6603.pdf (874.8 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04611598 , version 1 (13-06-2024)

Identifiants

Citer

Dario Nisi, Mariano Graziano, Yanick Fratantonio, Davide Balzarotti. Lost in the Loader:The Many Faces of the Windows PE File Format. RAID 2021, 24th International Symposium on Research in Attacks, Intrusions and Defenses, ACM, Oct 2021, San Sebastian, Spain. ⟨10.1145/3471621.3471848⟩. ⟨hal-04611598⟩

Collections

EURECOM
1 Consultations
1 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More