Cryptographic Function • Encryption and decryption procedure
3
Crypto Functions in Malware
4
Why Detect Crypto Functions? • Provide a starting point for reverse engineering
5
Crypto Function Attributes
6
Existing Detection Methods
7
Challenges
8
Our Method
9
Overview * Equivalence check on loop bodies in the
10
Loop Detection
11
Bit Symbolic Execution
12
Equivalence Checking • Replace the mapped input variables with new
13
Evaluation
14
Summary
Description:
Explore a 24-minute IEEE conference talk on detecting cryptographic functions in obfuscated binaries using bit-precise symbolic loop mapping. Delve into the challenges of identifying crypto functions in malware and learn about a novel technique that captures algorithm semantics through bit-precise symbolic execution. Discover how this approach, implemented in the CryptoHunt prototype, effectively detects common cryptographic functions like TEA, AES, RC4, MD5, and RSA under various obfuscation schemes. Gain insights into the importance of crypto function detection for malware defense and forensics, and understand the limitations of existing methods when dealing with obfuscated binaries.
Cryptographic Function Detection in Obfuscated Binaries via Bit-Precise Symbolic Loop Mapping