Home

About

Advanced Search

Browse by Discipline

Scientific Societies

E-print Alerts

Add E-prints

E-print Network
FAQHELPSITE MAPCONTACT US


  Advanced Search  

 
Anti-Disassembly using Cryptographic Hash John Aycock, Rennie deGraaf, and Michael Jacobson, Jr.
 

Summary: Anti-Disassembly using Cryptographic Hash
Functions
John Aycock, Rennie deGraaf, and Michael Jacobson, Jr.
Department of Computer Science
University of Calgary
Calgary, Alberta, Canada
{aycock,degraaf,jacobs}@cpsc.ucalgary.ca
TR 2005-793-24
Abstract
Computer viruses sometimes employ coding techniques intended to make anal-
ysis difficult for anti-virus researchers; techniques to obscure code to impair static
code analysis are called anti-disassembly techniques. We present a new method of
anti-disassembly based on cryptographic hash functions which is portable, hard to
analyze, and can be used to target particular computers or users. Furthermore, the
obscured code is not available in any analyzable form, even an encrypted form, un-
til it successfully runs. The method's viability has been empirically confirmed. We
look at possible countermeasures for the basic anti-disassembly scheme, as well as
variants scaled to use massive computational power.
1 Introduction
Computer viruses whose code is designed to impede analysis by anti-virus researchers

  

Source: Aycock, John - Department of Computer Science, University of Calgary

 

Collections: Computer Technologies and Information Sciences