Helping Johnny To Analyze Malware: A

danika-pritchard
Published  · 19 slides · 0 views
↓ Download
Helping Johnny To Analyze Malware: A
1 / 1
Helping Johnny To Analyze Malware: A - slide 1 of 19 Helping Johnny To Analyze Malware: A - slide 2 of 19 Helping Johnny To Analyze Malware: A - slide 3 of 19 Helping Johnny To Analyze Malware: A - slide 4 of 19 Helping Johnny To Analyze Malware: A - slide 5 of 19 Helping Johnny To Analyze Malware: A - slide 6 of 19 Helping Johnny To Analyze Malware: A - slide 7 of 19 Helping Johnny To Analyze Malware: A - slide 8 of 19 Helping Johnny To Analyze Malware: A - slide 9 of 19 Helping Johnny To Analyze Malware: A - slide 10 of 19 Helping Johnny To Analyze Malware: A - slide 11 of 19 Helping Johnny To Analyze Malware: A - slide 12 of 19 Helping Johnny To Analyze Malware: A - slide 13 of 19 Helping Johnny To Analyze Malware: A - slide 14 of 19 Helping Johnny To Analyze Malware: A - slide 15 of 19 Helping Johnny To Analyze Malware: A - slide 16 of 19 Helping Johnny To Analyze Malware: A - slide 17 of 19 Helping Johnny To Analyze Malware: A - slide 18 of 19 Helping Johnny To Analyze Malware: A - slide 19 of 19
Description
Helping Johnny To Analyze Malware: A Usability-Optimized Decompiler and Malware Analysis User Study Khaled Yakdan University of Bonn Fraunhofer FKIE Sergej Dechand University of Bonn Elmar Gerhards-Padilla Fraunhofer FKIE Matthew Smith

Related Topics

Download this presentation From Below

"Helping Johnny To Analyze Malware: A" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation Transcript

01
Helping Johnny To Analyze Malware: A Usability-Optimized Decompiler and Malware Analysis User Study Khaled Yakdan
University of Bonn
Fraunhofer FKIE Sergej Dechand
University of Bonn Elmar Gerhards-Padilla
Fraunhofer FKIE Matthew Smith
University of Bonn IEEE Symposium on Security and Privacy 2016<br>
02
Which code would you rather analyze? 080483f9 <bar>:
80483f9: push %ebp
80483fa: mov %esp,%ebp
80483fc: sub $0x10,%esp
80483ff: movl $0x0,-0x4(%ebp)
8048406: movl $0x1,-0x8(%ebp)
804840d: cmpl $0x0,0x8(%ebp)
8048411: jle 8048435 <bar+0x3c>
8048413: pushl -0x4(%ebp)
8048416: call 80483cb <foo>
804841b: add $0x4,%esp
804841e: mov %eax,%edx
8048420: mov -0x8(%ebp),%eax
8048423: imul %edx,%eax
8048426: mov %eax,-0x8(%ebp)
8048429: addl $0x1,-0x4(%ebp)
804842d: mov -0x4(%ebp),%eax
8048430: cmp 0x8(%ebp),%eax
8048433: jl 8048413 <bar+0x1a>
8048435: mov -0x8(%ebp),%eax
8048438: leave
8048439: ret int bar(int a1){ int v1 = 0; int v2 = 1; if(a1 > 0){ do{ v2 = v2 * foo(v1); v1 = v1 + 1; } while(v1 < a1); } return v2; } int bar(int max){ int result = 1; for(int i = 0 ; i < max ; i++){ result = result * foo(i); } return result; }<br>
03
Decompilation 10100101010010101010100101010100001001000011100101 i = 0;
while(i < size){
foo(i);
i = i + 1;
} Compiler Decompiler v2 = 0;
if(v1 != 0){
do{
foo(v2);
v2 = v2 + 1;
} while(v2 < v1);
} Source Code Decompiled Code Binary Code High-level abstractions are lost Recovered abstractions<br>