A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866910271780421632 |
|---|---|
| author | Kim, Wanju Lee, Seoksu Cho, Eun-Sun |
| author_facet | Kim, Wanju Lee, Seoksu Cho, Eun-Sun |
| contents | Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including memory analysis and trace analysis, while minimizing dependency on the specific internal structure of virtual machines in order to handle diverse forms of virtualization obfuscation that existing tools are unable to process. Experimental results demonstrate that the length of obfuscated programs was reduced by approximately 85%, and it was verified through validation that small-scale programs were fully restored to semantics identical to the original. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_30902 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation Kim, Wanju Lee, Seoksu Cho, Eun-Sun Cryptography and Security Virtualization obfuscation is a more powerful obfuscation technique compared to other obfuscation methods, and as it is increasingly being applied to malware, it demands significant effort and time from analysts. This study analyzes virtualization obfuscation and proposes a tool called VMPredator that automatically extracts semantic units. The proposed tool performs various analyses including memory analysis and trace analysis, while minimizing dependency on the specific internal structure of virtual machines in order to handle diverse forms of virtualization obfuscation that existing tools are unable to process. Experimental results demonstrate that the length of obfuscated programs was reduced by approximately 85%, and it was verified through validation that small-scale programs were fully restored to semantics identical to the original. |
| title | A Core-Structure-Based Automated Analysis Tool for Commercial Virtualization Obfuscation Deobfuscation |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2605.30902 |