[转帖]Hump-and-Dump: Efficient Generic Unpacking by Li Sun, Tim Ebringer, Serdar Bozta-安全工具-看雪-安全社区|安全招聘|kanxue.com

[转帖]Hump-and-Dump: Efficient Generic Unpacking by Li Sun, Tim Ebringer, Serdar Bozta

发表于: 2008-7-20 23:50 3042

[转帖]Hump-and-Dump: Efficient Generic Unpacking by Li Sun, Tim Ebringer, Serdar Bozta

linhanshi

2008-7-20 23:50

3042

Hump-and-Dump: Efficient Generic Unpacking by Li Sun, Tim Ebringer, Serdar Bozta

We present a new and efficient generic unpacking algorithm which effectively locates the original entry point (OEP) area of a packed program. The algorithm is based upon the dual observation that (a) even in a packed program, the OEP bytes are almost always only executed once, and (b) most packers unpack the original program to an area of memory which has not been previously executed. Given this, the technique relies upon creating a histogram of the addresses of executed instructions (EIP on x86). Whilst others have done this, the trick is to order the histogram by the last time an address is executed. Decryption, decompression and copying appear as large spikes at the start of the histogram, followed by a flat section, of height one, which is usually the OEP. We attach figures showing histograms for some popular packers, on both linear and log scales, which clearly illustrate the OEP after the massive unpacking “hump”.

This technique is extremely efficient to implement, and can compute the OEP “on-the-fly” in an emulator, or off-line from a trace of EIP. For instance, for UPX 2.03w, we need less than 1K of memory to hold the necessary data structures, and computation is similarly cheap (and compatible with dynamic-translation emulators). Given the shape of the chart, and the fact that after the “hump” represents a good opportunity to dump the memory, we have given this technique the somewhat sordid name of hump-and-dump.

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

#[other]

上传的附件：

Hump-and-Dump_Efficient_Generic_Unpacking.rar （1.02MB，145次下载）

收藏・0

免费・1

支持

最新回复 (1)
NWMonster 雪币： 134 活跃值： (84) 能力值： ( LV5，RANK：60 ) 在线值：发帖 26 回帖 457 粉丝 8 关注私信	NWMonster 1 2 楼很厉害的文章，在欧洲的一个安全研讨会上见过。 2008-7-21 11:21 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

linhanshi

9256

发帖

27966

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

专注于PC、移动、智能设备安全研究及逆向工程的开发者社区

最新回复 (1)
NWMonster 雪币： 134 活跃值： (84) 能力值： ( LV5，RANK：60 ) 在线值：发帖 26 回帖 457 粉丝 8 关注私信	NWMonster 1 2 楼很厉害的文章，在欧洲的一个安全研讨会上见过。 2008-7-21 11:21 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复