16

virtualizers usage in the wild They are rarely used, and even worse (or better), rarely used in a useful way. how they're used Typically, it was the use of a virtualizer of over only the main function, or another binary packer, and both cases don't prevent analysis: if you bypass the virtualized packer code, then you get the original unpacked code anyway. ...


8

Regarding question #1, no IDA does not handle obfuscated binaries. You might be interested by the Virtual Deofbuscator talk Jason Raber gave at Blackhat last year, he also released an IDA plugin and the source code is available. Slides : https://media.blackhat.com/us-13/US-13-Raber-Virtual-Deobfuscator-A-DARPA-Cyber-Fast-Track-Funded-Effort-Slides.pdf ...


7

First of all, the fact to turn a program into a bytecode that will be interpreted by a crafted VM which will be embedded into the software is a quite well-known technique of obfuscation. There have been numerous writings about it. If you want to find good pointers about it (and how to solve it in different ways), I would advise you to search for "VM-based ...


6

I can support the presented view of the other responders. You will rarely encounter code virtualization when looking at in the wild samples. Just to add, here is a recent case-study by Tora looking at the custom virtualization used in FinFisher (sorry, direct link to PDF, have no other source). The VM used here has only 11 opcodes, thus this example can be ...


4

You should take a look at crackmes.de, especially level 6, like this one, or this one.


3

To the first part of your question: It really depends on the domain. Malware samples that leverage virtualization-based packers are generally easy to detect, which is a drawback from the malware author's perspective. If avoiding detection is crucial, which is especially the case in targeted attacks where your sample is probably custom anyway, virtualized ...


3

In the last year or so, I think I have only encountered a single malware sample that was using a virtualized packer (VMProtect in that case). Most of the samples I look at use stupid packers that allow easy dumping of the original PE from memory. I don't spend all of my time looking at malware, but I typically look at a couple potentially malicious samples ...


3

First, note that most industrial-strength networking devices don't use Linux. If they did, mosts parts of the software would have to be provided in source code to comply with GPL requirements. So while your $100 Linksys router might use Linux, your $3000 Cisco router won't, and it won't be running snort either. (Cisco's IDS and Snort might have several ...


1

One would have to look at the code. How are the jump targets calculated? From your diagrams it could also be something as simple as: void jump_to_x_plus_5(uint x) { jmp x+5; } void jump_to_x_plus_7(uint x) { jmp x+7; } void jump_to_x_plus_9(uint x) { jmp x+9; } And they just replaced all absolute jumps in the .asm with calls to random.choice() of those ...


Only top voted, non community-wiki answers of a minimum length are eligible