The Reversing Machine: Reconstructing Memory Assumptions

arXiv:2405.00298v1 Announce Type: new
Abstract: Existing anti-malware software and reverse engineering toolkits struggle with stealthy sub-OS rootkits due to limitations of run-time kernel-level monitoring. A malicious kernel-level driver can bypass OS-level anti-virus mechanisms easily. Although static analysis of such malware is possible, obfuscation and packing techniques complicate offline analysis. Moreover, current dynamic analyzers suffer from virtualization performance overhead and create detectable traces that allow modern malware to evade them.
To address these issues, we present \textit{The Reversing Machine} (TRM), a …

analysis anti-malware anti-malware software arxiv bypass can cs.cr current driver dynamic engineering kernel limitations machine malicious malware memory monitoring obfuscation offline reverse reverse engineering reversing rootkits run software static analysis techniques virus