An Approach towards Disassembly of Malicious Binary Executables

Analysis of a binary executable starts with disassembly. Current methods start disassembling a program from an entry point, and continue disassembling either by a simple linear scan or by following the execution paths using static analysis. A hostile programmer can easily fool such methods for disassembly and cause confusion between code and data. A method for disassembling that does not leave any code behind is proposed. The method does not depend on an entry point; instead, it treats every byte as a potential entry point. It partitions the code into segments where a segment is a largest sequence of instructions terminated by an instruction, such as JUMP, that explicitly modifies the program counter. A segment is invalid if its execution will always lead into data. The method filters out invalid segments. It finally connects all the code segments to give a “precise disassembly.” Results from using the method on ten programs are presented. We have implemented Binary Disassembler for Malicious Executables (BDME). BDME is a disassembler that is written specifically to target malicious code and obfuscated binaries. For our test data, we are able to reduce up to 87% of false positives while getting no false negatives. BDME is able to find all the potential instructions in the code, thus making it very hard to hide malicious code from analysis through disassembly. The average reduction of 46% of false positives further helps the disassembler in keeping the disassembly precise.