SMODIC: A Model Checker for Self-modifying Code - CNRS - Centre national de la recherche scientifique Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

SMODIC: A Model Checker for Self-modifying Code

Résumé

In this paper, we present SMODIC, a model checker for selfmodifying binary codes. SMODIC uses Self Modifying Pushdown Systems (SM-PDS) to model self-modifying binary code. This allows to faithfully represent the program's stack as well as the self-modifying instructions of the program. SMODIC takes a selfmodifying binary code or a self modifying pushdown system as input. It can then perform reachability analysis and LTL/CTL modelchecking for these models. We successfully used SMODIC to modelcheck more than 900 self-modifying binary codes. In particular, we applied SMODIC for malware detection, since malwares usually use self-modifying instructions, and since malicious behaviors can be described by LTL or CTL formulas. In our experiments, SMODIC was able to detect 895 malwares and to prove that 200 benign programs were benign. SMODIC was also able to detect several malwares that well-known antiviruses such as Bit-Defender, Kinsoft, Avira, eScan, Kaspersky, Baidu, Avast, and Symantec failed to detect. SMODIC can be found in https://lipn.univ-paris13.fr/~touili/smodic
Fichier principal
Vignette du fichier
main.pdf (489.97 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03863300 , version 1 (21-11-2022)

Identifiants

  • HAL Id : hal-03863300 , version 1

Citer

Tayssir Touili, Xin Ye. SMODIC: A Model Checker for Self-modifying Code. The 17th International Conference on Availability, Reliability and Security, 2022, Vienna, Austria. ⟨hal-03863300⟩

Collections

CNRS
5 Consultations
38 Téléchargements

Partager

Gmail Facebook X LinkedIn More