REveal: Unmasking Malware’s True Identity

Presented at ShmooCon 2023, Jan. 22, 2023, 10 a.m. (60 minutes).

Traditionally, malware detection is accomplished using techniques such as signature matching (easily defeated by binary obfuscation) or by executing the binary in a sandbox (onerous and time-consuming). REveal defeats obfuscation methods by extracting data flow slices and analyzing matches against a database of software pre-analyzed by REveal. By looking at the list of files matching each data flow slice, REveal can find the boundaries of common inline functions, statically linked code modules, and the malware’s unique operations. This results in quicker and more accurate malware identification versus conventional processes. In this talk, I will talk about the challenges reverse engineers face in detecting obfuscated malware, show how REveal works to overcome some of these challenges, run through a real-life example, and share how attendees can contribute to future enhancements to this open source project.


Presenters:

  • Scott Young
    Scott Young enjoys breaking software. A buffer overflow here, a speculative side channel there, and Scott is a happy camper. Scott has been reverse engineering for 16 years and has lost count of how many Ghidra and Binary Ninja plugins he has written. Scott has built reverse engineering frameworks that turn high-end desktops into room heaters.

Similar Presentations: