Hiding PIN's Artifacts to Defeat Evasive Malware
summary
Describes a DBI-hardening framework built on Intel Pin with a pattern-matching module that patches INT 0x2E and FP checks, a fake read handler module that redirects reads/writes to hide code-cache and allocation artifacts, and a fakery-detection module that spoofs hooked prologues. Tests run on ~7,000 malware samples from VirusTotal, finding several families 100% evasive and an unpacker (PinDemonium integration) that reconstructs runnable EXEs for >60% of random packers; added defenses cost up to ~254% extra overhead in some modules.
AI-written summary · about
chapters (16)
- 0:00Start
- 7:57DBI - Evasive Malware
- 9:22Code Cache Artifacts
- 9:56CCA-IP Detection
- 12:33CCA - IP Detection
- 13:59CCA-Self Modifying Code
- 18:35black hat Arancino - Hooking Module
- 21:09Environment Artifacts
- 21:24black hat EA - Memory Fingerprinting
- 24:34JIT Compiler Detection
- 25:56JITC Detection - DLL Hook
- 26:27JITC Detection - DDL Hook
- 31:00Overhead Detection
- 37:41Top Evasive Malware
- 40:42Unpacking Approach
- 45:40Black Hat Sound Bytes
related talks
20mBluePill: Neutralizing Anti-Analysis Behavior in Malware Dissection
25mPindemonium: A DBI-Based Generic Unpacker for Windows Executable
45m"Advanced Malware Threat: handling obfuscated code using..."
45mBreak Out of The Truman Show: Active Detection and Escape of Dynamic Binary Instrumentation
52mFlying Under the Radar - New Security Evasion Techniques
26mOne Packer to Rule Them All
27mDetecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries
24mDefeating the Transparency Feature of DBI