cguest
November 11th, 2003, 04:01 PM
1.
Wayne has announced that TDS-4 will feature an emulation (generic unpacking engine). I find this quite interesting because of the following reasons:
Many AV scanners have an emulation that can simulate the execution of encrypted viruses in a kind of virtual machine. However, I do not know many AV/AT software producers who have developed an emulation which is able to deal with non trivial containers (i.e., run-time compressors like UPX, PE crypters or commercial protectors). IMHO, even Kaspersky AV does not have a working emulation but uses a static unpacking engine.
Static unpacking engines cannot unpack unkown compressors / crypters / protectors because they require a "signature match" before the static unpacking routines come into play. Moreover, static unpacking engines are vulnerable to OEP obfuscation techniques and other modifications of the unpacking stub of a compressed malware sample. This leads to a rather unpleasant situation. Every script kiddy can camouflage a trojan by compressing it with an unkown packer, a known packer whose unpacking stub has been modified, or a sophisticated commercial protector like Armadillo. No AV scanner will detect such samples unless it uses "weak" signatures taken from the resource section like McAfee does. (Allegedly, AV producers consider it impossible to automatically unpack sophisticated commercial protectors like Armadillo.) The only defense against such protected trojans are memory scanners like they are used by BOClean, TDS or Trojan Hunter.
2.
The question is whether an emulation will solve this problem. In theory, an emulation should be able to unpack every compressed / crypted trojan. However, the coding of an emulation is complex and quite tricky. For example, the coder has to take care of the following issues:
a)
If an executable contains uncommon opcodes, which are not supported by the emu, the emu may crash or be unable to correctly process the file. A malware coder may intentionally use uncommon opcodes.
b)
An emulated virtual machine is slow. Mucher slower than a real computer. An emu will not merely slow down the speed of a scanner. There is also the risk that a malware coder will try to exploit the speed difference between a real computer and the emulation (e.g., by adding wait loops to the malware's code).
c)
Commercial protectors (or malware coders) may use anti-debugging techniques which prevent a file from being executed in a virtual machine (i.e., an executable may try to figure out whether it is executed on a real computer and may stop running if it finds itself running in a virtual machine).
3.
Therefore, it comes as a big surprise to me that a small company like DCS has developed an emulation (and not only a static unpacking engine for a limited number of packers). It will be interesting to figure out how powerful the emu is. Allegedly, NOD32 Version 2 uses an emu, too. However, it is not able to unpack sophisticated commercial protectors. Moreover, Andreas Haak is working on an emulation for a long time. But it has not been released yet.
In summary, I am pretty excited ... ;-)
Wayne has announced that TDS-4 will feature an emulation (generic unpacking engine). I find this quite interesting because of the following reasons:
Many AV scanners have an emulation that can simulate the execution of encrypted viruses in a kind of virtual machine. However, I do not know many AV/AT software producers who have developed an emulation which is able to deal with non trivial containers (i.e., run-time compressors like UPX, PE crypters or commercial protectors). IMHO, even Kaspersky AV does not have a working emulation but uses a static unpacking engine.
Static unpacking engines cannot unpack unkown compressors / crypters / protectors because they require a "signature match" before the static unpacking routines come into play. Moreover, static unpacking engines are vulnerable to OEP obfuscation techniques and other modifications of the unpacking stub of a compressed malware sample. This leads to a rather unpleasant situation. Every script kiddy can camouflage a trojan by compressing it with an unkown packer, a known packer whose unpacking stub has been modified, or a sophisticated commercial protector like Armadillo. No AV scanner will detect such samples unless it uses "weak" signatures taken from the resource section like McAfee does. (Allegedly, AV producers consider it impossible to automatically unpack sophisticated commercial protectors like Armadillo.) The only defense against such protected trojans are memory scanners like they are used by BOClean, TDS or Trojan Hunter.
2.
The question is whether an emulation will solve this problem. In theory, an emulation should be able to unpack every compressed / crypted trojan. However, the coding of an emulation is complex and quite tricky. For example, the coder has to take care of the following issues:
a)
If an executable contains uncommon opcodes, which are not supported by the emu, the emu may crash or be unable to correctly process the file. A malware coder may intentionally use uncommon opcodes.
b)
An emulated virtual machine is slow. Mucher slower than a real computer. An emu will not merely slow down the speed of a scanner. There is also the risk that a malware coder will try to exploit the speed difference between a real computer and the emulation (e.g., by adding wait loops to the malware's code).
c)
Commercial protectors (or malware coders) may use anti-debugging techniques which prevent a file from being executed in a virtual machine (i.e., an executable may try to figure out whether it is executed on a real computer and may stop running if it finds itself running in a virtual machine).
3.
Therefore, it comes as a big surprise to me that a small company like DCS has developed an emulation (and not only a static unpacking engine for a limited number of packers). It will be interesting to figure out how powerful the emu is. Allegedly, NOD32 Version 2 uses an emu, too. However, it is not able to unpack sophisticated commercial protectors. Moreover, Andreas Haak is working on an emulation for a long time. But it has not been released yet.
In summary, I am pretty excited ... ;-)