Communication Dans Un Congrès Année : 2024

Reachability Analysis of Concurrent Self-modifying Code

Résumé

We introduce a new effective way to analyze multi-threaded programs that contain self modifying code, i.e., code that modifies itself during its execution. This kind of code is widely used in malware to hide the malicious portions of their code. We introduce a new model called Self Modifying Dynamic Pushdown Network (SM-DPN) to model such programs. A SM-DPN is a network of Self-Modifying Pushdown Systems, i.e., Pushdown Systems that can modify their instructions on the fly during execution. We use finite automata to model regular infinite sets of configurations of SM-DPNs, and propose an algorithm to compute a finite automaton corresponding to the pre* reachable configurations of SM-DPNs. This allows to perform the backward reachability analysis of self modifying multi-threaded programs. We implemented our techniques in a tool and obtained encouraging results. In particular, our tool was able to detect a self-modifying multithreaded malware.

Fichier principal
Vignette du fichier
main.pdf (321.43 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Licence

Dates et versions

hal-04766984 , version 1 (12-11-2024)
hal-04766984 , version 2 (14-03-2025)

Licence

Identifiants

Citer

Walid Messahel, Tayssir Touili. Reachability Analysis of Concurrent Self-modifying Code. 28th International Conference on Engineering of Complex Computer Systems, Jun 2024, Limassol (Chypre), Cyprus. pp.257-271, ⟨10.1007/978-3-031-66456-4_14⟩. ⟨hal-04766984v1⟩
114 Consultations
261 Téléchargements

Altmetric

Partager

  • More