Systém pro podporu platformě nezávislé analýzy škodlivého kódu ve spustitelných souborech

Project Period: 1. 1. 2011 – 31. 12. 2013

Project Type: grant

Code: TA01010667

Agency: Technologická agentura ČR

Program: Program aplikovaného výzkumu a experimentálního vývoje ALFA

English title

System for Support of Platform Independent Malware Analysis in Executable Files

Type

grant

Keywords

malware, anti-virus, reverse engineering, security, code analysis, code transformation, compiler, decompiler, disassembler

Abstract

The primary objective of this project is creation of compact system for support of malware analysis. This system will be able to analyze binary executable code, no matter which format or platform was the file created for. Compact, functionally equivalent form of representation will be the output of analysis process. Special computer language will designed for this purpose. Usage of such system will lead to expansion of the anti-virus industry to new markets like mobile phones, multimedia players, etc.

Team members

Krčma Pavel – research leader
Obluk Karel, Ing., Ph.D. – research leader
Ďurfina Lukáš, Ing., Ph.D.
Kolář Dušan, doc. Dr. Ing. (DIFS)
Křoustek Jakub, Ing., Ph.D.
Zemek Petr, Ing., Ph.D.

Publications

2013

ĎURFINA, L.; KOLÁŘ, D. Generic detection of the statically linked code. Proceedings of the Twelfth International Conference on Informatics INFORMATICS 2013. Spišská Nová Ves: Faculty of Electrical Engineering and Informatics, University of Technology Košice, 2013. p. 157-161. ISBN: 978-80-8143-127-2. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P. Retargetable Machine-Code Decompilation in Your Web Browser. 3rd IEEE World Congress on Information and Communication Technologies (WICT 2013). Hanoi: IEEE Computer Society, 2013. p. 57-62. ISBN: 978-1-4799-3230-6. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P. Psyb0t Malware: A Step-By-Step Decompilation Case Study. In 20th Working Conference on Reverse Engineering (WCRE). Koblenz: IEEE Computer Society, 2013. p. 449-456. ISBN: 978-1-4799-2930-6. Detail
KŘOUSTEK, J. Decompilation of VLIW Executable Files - Caveats and Pitfalls. 3nd International Scientific Conference Theoretical and Applied Aspects of Cybernetics. Kyiv: Cybernetics Faculty of Taras Shevchenko National University of Kyiv, 2013. p. 287-296. ISBN: 978-966-399-538-0. Detail
KŘOUSTEK, J.; KOLÁŘ, D. Preprocessing of Binary Executable Files Towards Retargetable Decompilation. 8th International Multi-Conference on Computing in the Global Information Technology (ICCGI'13). Nice: International Academy, Research, and Industry Association, 2013. p. 259-264. ISBN: 978-1-61208-283-7. Detail
KŘOUSTEK, J.; KOLÁŘ, D. Approaching Retargetable Static, Dynamic, and Hybrid Executable-Code Analysis. Acta Informatica Pragensia, 2013, vol. 2, no. 1, p. 18-29. ISSN: 1805-4951. Detail
KŘOUSTEK, J.; KOLÁŘ, D. Context Parsing (Not Only) of the Object-File-Format Description Language. COMPUT SCI INF SYST, 2013, vol. 10, no. 4, p. 1673-1702. ISSN: 1820-0214. Detail
MATULA, P.; KOLÁŘ, D. Reconstruction of simple data types in decompilation. Sborník příspěvků Mezinárodní Masarykovy konference pro doktorandy a mladé vědecké pracovníky 2013. Hradec Králové: Akademické sdružení MAGNANIMITAS Assn., 2013. p. 1-10. ISBN: 978-80-87952-00-9. Detail

2012

ĎURFINA, L.; KOLÁŘ, D. C Source Code Obfuscator. Kybernetika, 2012, vol. 48, no. 3, p. 0-0. ISSN: 0023-5954. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P. Generic Source Code Migration Using Decompilation. 10th Annual Industrial Simulation Conference (ISC'2012). Brno: EUROSIS, 2012. p. 38-42. ISBN: 978-90-77381-71-7. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KÁBELE, B. Accurate Recovery of Functions in a Retargetable Decompiler. The 15th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2012). Lecture Notes in Computer Science. Amsterdam: Springer Verlag, 2012. p. 390-392. ISBN: 978-3-642-33337-8. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KÁBELE, B. Detection and Recovery of Functions and their Arguments in a Retargetable Decompiler. 19th Working Conference on Reverse Engineering (WCRE 2012). Kingston, Ontario: IEEE Computer Society, 2012. p. 51-60. ISBN: 978-0-7695-4891-3. Detail
KŘOUSTEK, J.; KOLÁŘ, D. Object-File-Format Description Language and Its Usage in Retargetable Decompilation. In AIP Conference Proceedings. AIP Conference Proceedings. Kos: American Institute of Physics, 2012. p. 466-469. ISBN: 978-0-7354-1091-6. ISSN: 1551-7616. Detail
KŘOUSTEK, J.; MATULA, P.; KONČICKÝ, J.; KOLÁŘ, D. Accurate Retargetable Decompilation Using Debug Information. Proceedings of the Sixth International Conference on Emerging Security Information, Systems and Technologies (SECURWARE'12). Rome: International Academy, Research, and Industry Association, 2012. p. 79-84. ISBN: 978-1-61208-209-7. Detail

2011

ĎURFINA, L.; KOLÁŘ, D. Generic detection of register realignment. AIP Conference Proceedings. AIP Conference Proceedings. Kassandra, Halkidiki: American Institute of Physics, 2011. p. 806-809. ISBN: 978-0-7354-0956-9. ISSN: 1551-7616. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KOLÁŘ, D.; HRUŠKA, T.; MASAŘÍK, K.; MEDUNA, A. Advanced Static Analysis for Decompilation Using Scattered Context Grammars. Proceedings of the Applied Computing Conference 2011 (ACC'11). Angers: World Scientific and Engineering Academy, 2011. p. 164-169. ISBN: 978-1-61804-051-0. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KOLÁŘ, D.; HRUŠKA, T.; MASAŘÍK, K.; MEDUNA, A. Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis. The 5th International Conference on Information Security and Assurance. Communications in Computer and Information Science, Volume 200. Brno: Springer Verlag, 2011. p. 72-86. ISBN: 978-3-642-23140-7. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KOLÁŘ, D.; HRUŠKA, T.; MASAŘÍK, K.; MEDUNA, A. Design of an Automatically Generated Retargetable Decompiler. 2nd European Conference of COMPUTER SCIENCE (ECCS'11). Puerto De La Cruz, Tenerife: North Atlantic University Union, 2011. p. 199-204. ISBN: 978-1-61804-056-5. Detail
ĎURFINA, L.; KŘOUSTEK, J.; ZEMEK, P.; KOLÁŘ, D.; HRUŠKA, T.; MASAŘÍK, K.; MEDUNA, A. Design of a Retargetable Decompiler for a Static Platform-Independent Malware Analysis. International Journal of Security and Its Applications, 2011, vol. 5, no. 4, p. 91-106. ISSN: 1738-9976. Detail
JIRÁK, O.; KOLÁŘ, D. Comparison of Classical and Lazy Approach in SCG Compiler. NUMERICAL ANALYSIS AND APPLIED MATHEMATICS ICNAAM 2011: International Conference on Numerical Analysis and Applied Mathematics. AIP Conference Proceedings. Halkidiki: American Institute of Physics, 2011. p. 873-876. ISBN: 978-0-7354-0956-9. ISSN: 1551-7616. Detail
KŘOUSTEK, J.; MATULA, P.; ĎURFINA, L. Generic Plugin-Based Converter of Object File Formats and Its Usage in Retargetable Decompilation. Proceedings of the 6th International Scientific and Technical Conference (CSIT'2011). Lviv: Ministry of Education, Science, Youth and Sports of Ukraine, Lviv Polytechnic National University, Institute of Computer Science and Information Technologies, 2011. p. 127-130. ISBN: 978-966-2191-04-2. Detail
KŘOUSTEK, J.; PŘIKRYL, Z.; KOLÁŘ, D.; HRUŠKA, T. Retargetable Multi-level Debugging in HW/SW Codesign. The 23rd International Conference on Microelectronics (ICM 2011). Hammamet: Institute of Electrical and Electronics Engineers, 2011. p. 1-6. ISBN: 978-1-4577-2209-7. Detail
KŘOUSTEK, J.; ŽIDEK, S.; KOLÁŘ, D.; MEDUNA, A. Scattered Context Grammars with Priority. International Journal of Advanced Research in Computer Science, 2011, vol. 2, no. 4, p. 1-6. ISSN: 0976-5697. Detail
PŘIKRYL, Z.; KŘOUSTEK, J.; HRUŠKA, T.; KOLÁŘ, D. Fast Just-In-Time Translated Simulator for ASIP Design. In 14th IEEE International Symposium on Design and Diagnostics of Electronic Circuits and Systems. Cottbus: IEEE Computer Society, 2011. p. 279-282. ISBN: 978-1-4244-9753-9. Detail