{"id":{"repo_id":"uiuc","oai_identifier":"oai:www.ideals.illinois.edu:2142/45595"},"canonical_url":"https://search.dev.ndltd.org/etd/uiuc/oai:www.ideals.illinois.edu:2142/45595","repository":{"repo_id":"uiuc","name":"University of Illinois - Urbana-Champaign","base_url":"https://www.ideals.illinois.edu/oai-pmh"},"display":{"title":"Automated static analysis of virtual-machine packers","abstract":"The ability to reverse the most advanced software protection schemes is a critical step in mitigating malicious code attacks. Unfortunately, the analyst side seems to be losing in the ongoing arms race between malware developers and reverse engineers. Obfuscation that takes advantage of a virtual- machine like architecture has proven to be one of the most difficult to deal with. Virtual-machine packers are able to hide the intentions of programs they are applied to and are resistant to formerly effective unpacking techniques. Others have proposed methods to deal with such complex protec- tions, but they are often tedious, expensive, and/or inflexible. We propose a novel approach to automate the analysis process of virtualization protected executables. Our design avoids many pit- falls and performance issues of dynamic-analysis systems by only employing static program-analysis techniques and emphasizing work-reuse and generality in order to maintain efficiency, flexibility, and accessibility, for even novice analysts. The proof-of-concept system we have developed shows promise for the future of virtual-machine protected software analysis.","abstract_html":"The ability to reverse the most advanced software protection schemes is a critical step in mitigating malicious code attacks. Unfortunately, the analyst side seems to be losing in the ongoing arms race between malware developers and reverse engineers. Obfuscation that takes advantage of a virtual- machine like architecture has proven to be one of the most difficult to deal with. Virtual-machine packers are able to hide the intentions of programs they are applied to and are resistant to formerly effective unpacking techniques. Others have proposed methods to deal with such complex protec- tions, but they are often tedious, expensive, and/or inflexible. We propose a novel approach to automate the analysis process of virtualization protected executables. Our design avoids many pit- falls and performance issues of dynamic-analysis systems by only employing static program-analysis techniques and emphasizing work-reuse and generality in order to maintain efficiency, flexibility, and accessibility, for even novice analysts. The proof-of-concept system we have developed shows promise for the future of virtual-machine protected software analysis.","abstract_has_math":false,"creators":["Leong, Joseph"],"institution":"University of Illinois at Urbana-Champaign","degree_name":"M.S.","degree_level":"Thesis","degree_discipline":"Computer Science","degree_department":null,"school":null,"contributors":["Caesar, Matthew C."],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2013,"date_issued":"2013-08-22T16:49:00Z","date_published":"2013-08-22T16:49:00Z","updated_at":"2026-07-22T22:25:36Z","subjects":["Program-Analysis","Low-level Systems"],"languages":["en"],"rights":["Copyright 2013 by Joseph Kwun Leong. All rights reserved."],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"http://hdl.handle.net/2142/45595","outbound_label":"Handle","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor","label":"Contributor","values":["Caesar, Matthew C."]},{"key":"dc:creator","label":"Author","values":["Leong, Joseph"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date","label":"Dc Date","values":["2013-08-22T16:49:00Z","2015-08-22T10:00:35Z","2013-08"]},{"key":"dc:type","label":"Dc Type","values":["text"]},{"key":"thesis:degree_discipline","label":"Discipline","values":["Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Thesis"]},{"key":"thesis:degree_name","label":"Degree Name","values":["M.S."]},{"key":"thesis:institution_name","label":"Thesis Institution Name","values":["University of Illinois at Urbana-Champaign"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Program-Analysis","Low-level Systems"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:language","label":"Dc Language","values":["en"]},{"key":"dc:rights","label":"Dc Rights","values":["Copyright 2013 by Joseph Kwun Leong. All rights reserved."]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["http://hdl.handle.net/2142/45595"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description","label":"Description","values":["The ability to reverse the most advanced software protection schemes is a critical step in mitigating malicious code attacks. Unfortunately, the analyst side seems to be losing in the ongoing arms race between malware developers and reverse engineers. Obfuscation that takes advantage of a virtual- machine like architecture has proven to be one of the most difficult to deal with. Virtual-machine packers are able to hide the intentions of programs they are applied to and are resistant to formerly effective unpacking techniques. Others have proposed methods to deal with such complex protec- tions, but they are often tedious, expensive, and/or inflexible. We propose a novel approach to automate the analysis process of virtualization protected executables. Our design avoids many pit- falls and performance issues of dynamic-analysis systems by only employing static program-analysis techniques and emphasizing work-reuse and generality in order to maintain efficiency, flexibility, and accessibility, for even novice analysts. The proof-of-concept system we have developed shows promise for the future of virtual-machine protected software analysis.","Item withdrawn by Mark Zulauf (zulauf@illinois.edu) on 2013-07-17T20:18:28Z Item was in collections: University of Illinois Theses & Dissertations (ID: 1) No. of bitstreams: 1 Leong_Joseph.pdf: 342080 bytes, checksum: ef3d2532aab6eeb2955919ea32917ed8 (MD5)","Made available in DSpace on 2013-08-22T16:49:00Z (GMT). No. of bitstreams: 2 Joseph_Leong.pdf: 341845 bytes, checksum: 8262c94e87650a486743b2f366ead3d6 (MD5) license.txt: 4060 bytes, checksum: 84bb2e47b9b6c55ad84db5784a80244d (MD5)","Item marked as restricted to the 'UIUC Users [automated]' Group (id=2) by Seth Robbins (srobbins@illinois.edu) on 2013-08-22T16:49:44Z Item is restricted until 2015-08-22T16:49:27Z","Restriction data tranferred 2014-07-01T11:34:28-05:00 Original Data Group with Access UIUC Users [automated] Release Date: 2015-08-22 11:49:27 UTC Reason: Author requested U of Illinois access only (OA after 2yrs) in Vireo ETD system","U of I Only Restriction Lifted for Item 45577 on 2015-08-22T10:00:35Z."]},{"key":"dc:title","label":"Title","values":["Automated static analysis of virtual-machine packers"]}]}],"canonical_facts":{"dc:contributor":["Caesar, Matthew C."],"dc:creator":["Leong, Joseph"],"dc:date":["2013-08-22T16:49:00Z","2015-08-22T10:00:35Z","2013-08"],"dc:description":["The ability to reverse the most advanced software protection schemes is a critical step in mitigating malicious code attacks. Unfortunately, the analyst side seems to be losing in the ongoing arms race between malware developers and reverse engineers. Obfuscation that takes advantage of a virtual- machine like architecture has proven to be one of the most difficult to deal with. Virtual-machine packers are able to hide the intentions of programs they are applied to and are resistant to formerly effective unpacking techniques. Others have proposed methods to deal with such complex protec- tions, but they are often tedious, expensive, and/or inflexible. We propose a novel approach to automate the analysis process of virtualization protected executables. Our design avoids many pit- falls and performance issues of dynamic-analysis systems by only employing static program-analysis techniques and emphasizing work-reuse and generality in order to maintain efficiency, flexibility, and accessibility, for even novice analysts. The proof-of-concept system we have developed shows promise for the future of virtual-machine protected software analysis.","Item withdrawn by Mark Zulauf (zulauf@illinois.edu) on 2013-07-17T20:18:28Z Item was in collections: University of Illinois Theses & Dissertations (ID: 1) No. of bitstreams: 1 Leong_Joseph.pdf: 342080 bytes, checksum: ef3d2532aab6eeb2955919ea32917ed8 (MD5)","Made available in DSpace on 2013-08-22T16:49:00Z (GMT). No. of bitstreams: 2 Joseph_Leong.pdf: 341845 bytes, checksum: 8262c94e87650a486743b2f366ead3d6 (MD5) license.txt: 4060 bytes, checksum: 84bb2e47b9b6c55ad84db5784a80244d (MD5)","Item marked as restricted to the 'UIUC Users [automated]' Group (id=2) by Seth Robbins (srobbins@illinois.edu) on 2013-08-22T16:49:44Z Item is restricted until 2015-08-22T16:49:27Z","Restriction data tranferred 2014-07-01T11:34:28-05:00 Original Data Group with Access UIUC Users [automated] Release Date: 2015-08-22 11:49:27 UTC Reason: Author requested U of Illinois access only (OA after 2yrs) in Vireo ETD system","U of I Only Restriction Lifted for Item 45577 on 2015-08-22T10:00:35Z."],"dc:identifier":["http://hdl.handle.net/2142/45595"],"dc:language":["en"],"dc:rights":["Copyright 2013 by Joseph Kwun Leong. All rights reserved."],"dc:subject":["Program-Analysis","Low-level Systems"],"dc:title":["Automated static analysis of virtual-machine packers"],"dc:type":["text"],"thesis:degree_discipline":["Computer Science"],"thesis:degree_level":["Thesis"],"thesis:degree_name":["M.S."],"thesis:institution_name":["University of Illinois at Urbana-Champaign"]},"updated_at":"2026-07-22T22:25:36Z"}