Author:
Park Yeongung,Choi Seokwoo,Choi Un Yeong,Jin Haimin,Nor Nurul Harzira Mohamad,Park Yongsu
Abstract
AbstractAs IoT devices are being widely used, malicious code is increasingly appearing in Linux environments. Sophisticated Linux malware employs various evasive techniques to deter analysis. The embedded trace microcell (ETM) supported by modern Arm CPUs is a suitable hardware tracer for analyzing evasive malware because it is almost artifact-free and has negligible overhead. In this paper, we present an efficient method to automatically find debugger-detection routines using the ETM hardware tracer. The proposed scheme reconstructs the execution flow of the compiled binary code from ETM trace data. In addition, it automatically identifies and patches the debugger-detection routine by comparing two traces (with and without the debugger). The proposed method was implemented using the Ghidra plug-in program, which is one of the most widely used disassemblers. To verify its effectiveness, 15 debugger-detection techniques were investigated in the Arm-Linux environment to determine whether they could be detected. We also confirmed that our implementation works successfully for the popular malicious Mirai malware in Linux. Experiments were further conducted on 423 malware samples collected from the Internet, demonstrating that our implementation works well for real malware samples.
Funder
National Research Foundation of Korea
Publisher
Springer Science and Business Media LLC
Reference45 articles.
1. Kleen, A. & Strong, B. Intel processor trace on linux. Tracing Summit2015 (2015).
2. ARM. Embedded trace macrocell architecture specification etmv 4.0 to etm 4.6 (2020). https://developer.arm.com/documentation/ihi0064/latest
3. Rohleder, R. Hands-on ghidra—A tutorial about the software reverse engineering framework. In Proceedings of the 3rd ACM Workshop on Software Protection 77–78 (2019).
4. Vengatesan, K., Kumar, A., Parthibhan, M., Singhal, A. & Rajesh, R. Analysis of mirai botnet malware issues and its prediction methods in internet of things. In Proceeding of the International Conference on Computer Networks, Big Data and IoT (ICCBI-2018) 120–126 (Springer, 2020).
5. Arm. Juno arm development platform soc technical reference manual. http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b/