PMP - Cost-Effective Forced Execution with Probabilistic Memory Pre-planning
Explore a novel approach to malware analysis through a conference talk on cost-effective forced execution using Probabilistic Memory Pre-planning (PMP). Delve into the challenges of exposing hidden malware behavior and learn how PMP overcomes limitations of existing techniques like X-Force. Discover the innovative memory pre-planning phase that pre-allocates and initializes a large buffer with carefully crafted random values. Understand how this method significantly improves execution speed, reduces false positives and negatives in program dependence detection, and exposes more malicious behaviors in recent malware samples. Examine the architecture, implementation, and probability analysis of PMP, along with its evaluation on SPEC 2000 and a case study on a C&C Bot malware sample.