BLUE KAIZEN CENTER OF IT SECURITY Cairo Security Camp 2010 Pokas x86 Emulator for Generic Unpacking Subject : This document gives the user a problem, its solution concept, Previous Solutions, Pokas x86 Emulator, Reliability, Getting the Emulator, Pokas x86 Emulator Design, Usage steps, Debugger Conditions, Debugger Examples and TODO. Author : Amr Thabet Version : 1.0 Date : July, 2010 Nb pages : 17 Pokas x86 Emulator for Generic Unpacking By Amr Thabet
[email protected] The Problem: Many packed worms : no time to reverse and step through the packer‟s code Many polymorphic viruses around change their decryptor code and algorithm Need to write a detection algorithm for such viruses The Solution Concept: We need an automatic unpacker Static Unpacker : very sensitive of any changes of the packer No Time for keeping up-to-date of every release of any Unpacker Dynamic Unpacker: not sensitive of the minor changes. It can unpack new packers. We need a Program runs the packed application until it unpacked and stop in the real OEP So we need a Debugger Why not a Debugger? Easily to be detected Dangerous Can‟t monitor the memory Writes Allows only breakpoints on a specific place in memory Previous Solutions: OllyBone: dangerous if it‟s not a packer and could be fooled It‟s not scriptable and semi-automatic It could be easy detected Ida-x86emu: doesn‟t monitor memory writes and no conditional Breakpoints Pandora’s Bochs: hard to be installed, hard to be customized very slow 200 secs for notepad.exe packed with PECompact 2 with a PC 3.14 GHz and 2.00 GB ram Pokas x86 Emulator It‟s a Dynamic link library Easily to be customized Monitor all memory writes and log up to 10 previous Eips and saves the last accessed and the last modified place in memory.