自修改、攻击性、压缩二进制程序的通用解包
Generic Unpacking of Self-modifying, Aggressive, Packed Binary Programs
摘要：
如今，大多数恶意软件应用程序都被打包或保护。这种技术特别适用于规避基于签名的检测器，也使逆向工程师或安全分析师的工作复杂化。人们必须花费在解包或解密恶意软件层上的时间通常非常长，实际上仍然是恶意软件分析的整个过程中最复杂的任务。在这份报告中，作者提出了MmmBop作为一个相对较新的概念，使用动态二进制插装技术，通过自修改和高度积极的打包二进制代码来解包和绕过检测。MmmBop能够处理大多数已知和未知的打包算法，它也适合成功绕过大多数当前使用的反反转技巧。这个框架不依赖于任何其他第三方软件，它完全是在用户模式（环3）开发。MmmBop支持IA-32体系结构，它的目标是Microsoft Windows XP，一些进一步的讨论将直接涉及这个操作系统。
英文摘要：
Nowadays most of the malware applications are either packed or protected. This techniques are applied especially to evade signature based detectors and also to complicate the job of reverse engineers or security analysts. The time one must spend on unpacking or decrypting malware layers is often very long and in fact remains the most complicated task in the overall process of malware analysis. In this report author proposes MmmBop as a relatively new concept of using dynamic binary instrumentation techniques for unpacking and bypassing detection by self-modifying and highly aggressive packed binary code. MmmBop is able to deal with most of the known and unknown packing algorithms and it is also suitable to successfully bypass most of currently used anti-reversing tricks. This framework does not depend on any other 3rd party software and it is developed entirely in user mode (ring3). MmmBop supports the IA-32 architecture and it is targeted for Microsoft Windows XP, some of the further deliberations will be referring directly to this operating system.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
