System and method for programmatic runtime de-obfuscation of obfuscated software utilizing virtual machine introspection and manipulation of virtual machine guest memory permissions
A system and method for performing runtime de-obfuscation of obfuscated malicious software code in a virtual machine is described. According to one embodiment, the method involves enumerating a first physical page associated with a first virtual address space of a first piece of analyzed software code. Herein, the first virtual address space is a portion of a virtual address space associated with the virtual machine. Thereafter, the first physical page is set a non-writable permission. Hence, upon detection of a write to the first physical page by the first piece of analyzed software code, a determination can be made that the first piece of analyzed software code may be categorized as malicious software code.
1. A computerized method for performing runtime analysis of software code in a virtual machine, the method comprising:
enumerating at least a first physical page corresponding to a first virtual address space of software code under analysis, the analysis occurring during runtime within the virtual machine, the first virtual address space being a first portion of a virtual address space associated with the virtual machine;
setting a permission of the first physical page to a non-writable permission, wherein the first physical page resides outside of the virtual machine;
performing, via virtual machine introspection, runtime de-obfuscation of the software code under analysis including
(i) tracking locations in the first virtual address space that are written to during analysis,
(ii) tracking locations in the first virtual address space at which an instruction of the software is executed during analysis, and
(iii) detecting when a first virtual location in the first virtual address space was written to and an instruction located at the first virtual location is executed, wherein the first virtual location corresponds to a first physical location in the first physical page having a permission of non-writable; and
responsive to detecting the first virtual location was written to and the instruction located at the first virtual location is executed, determining that the instruction at the first virtual location corresponds to obfuscated malicious software code.
2. The computerized method of claim 1 further comprising updating a permission of the first physical page to non-executable in response to the write to the first physical page being from the first piece of the analyzed software code.
3. The computerized method of claim 2 , wherein the first virtual address space and the virtual-to-physical address memory mapping is updated every time a process changes, the first piece of the analyzed software changes, or the page table changes.
4. The computerized method of claim 1 , wherein the enumerating of the first physical page comprises traversing a page table that defines a virtual-to-physical memory mapping for a processor or conducting an analysis of operating system process tracking structures.
5. The computerized method of claim 1 , wherein the enumerating of the first physical page comprises comparing byte strings contained in the first piece of analyzed software code being a binary executable.
6. The computerized method of claim 1 , wherein the detecting of the write to the first physical page comprises tracking a memory address associated with the first physical page that is written to by the first piece of analyzed software code operating in the virtual machine.
7. The computerized method of claim 1 , wherein the detecting of the write to the first physical page occurs after de-obfuscation a second piece of the analyzed software code that corresponds to the first piece of analyzed software code.
8. The computerized method of claim 1 , wherein the introspection of the virtual machine comprises utilizing a library to read memory allocated for use by the virtual machine.
9. A computerized method for performing runtime de-obfuscation of obfuscated malicious software code in a virtual machine, the method comprising:
providing a virtual address space and a virtual-to-physical address mapping for use in execution of a first piece of software code, the virtual address space being a portion of a virtual address space associated with the virtual machine;
during runtime of the virtual machine, updating the virtual address space and the virtual-to-physical address mapping in response to at least (i) a process change, (ii) a change of software code being analyzed, or (iii) a change in at least one page table associated with the virtual-to-physical address mapping, and
performing, via virtual machine introspection, runtime de-obfuscation of the first piece of software code being analyzed including
(i) detecting when a first virtual location in the first virtual address space was written to and, subsequently, software code at the first virtual location was executed, wherein the first virtual location corresponds to a first physical location in the first physical page having a permission of non-writable, and
(ii) determining that the software code at the first virtual location corresponds to obfuscated software code.
10. The computerized method of claim 9 , wherein the process change includes a write operation conducted on a first physical page that is associated with the virtual address space and set to a non-writable permission.
11. The computerized method of claim 9 , wherein the process change includes detecting a write operation conducted on a first physical page that is associated with the virtual address space and set to a non-writable permission.
12. The computerized method of claim 11 , wherein the detecting of the write operation comprises tracking a memory address associated with the first physical page that is written to by the first piece of analyzed software code operating in the virtual machine.
13. The computerized method of claim 11 , wherein the detecting of the write operation occurs after de-obfuscation a second piece of the analyzed software code that corresponds to the first piece of software code.
14. A system comprising:
a processor; and
a storage medium communicatively coupled to the processor, the storage medium includes one or more software modules that, upon execution by the processor, perform operations that comprise
enumerating at least a first physical page corresponding to a first virtual address space of software code under analysis, the analysis occurring during runtime within the virtual machine, the first virtual address space being a first portion of a virtual address space associated with the virtual machine;
setting a permission of the first physical page to a non-writable permission, wherein the first physical page resides outside of the virtual machine;
performing, via virtual machine introspection, runtime de-obfuscation of the software code under analysis including
(i) tracking locations in the first virtual address space that are written to during analysis,
(ii) tracking locations in the first virtual address space at which an instruction of the software is executed during analysis, and
(iii) detecting when a first virtual location in the first virtual address space was written to and an instruction located at the first virtual location is executed, wherein the first virtual location corresponds to a first physical location in the first physical page having a permission of non-writable; and
responsive to detecting the first virtual location was written to and the instruction located at the first virtual location is executed, determining that the instruction at the first virtual location corresponds to obfuscated software code.
15. The system of claim 14 , wherein the one or more modules, upon execution by the processor, further perform an operation of updating a permission of the first physical page to non-executable in response to the write to the first physical page being from the first piece of the analyzed software code.
16. The system of claim 14 , wherein the enumerating of the first physical page, upon execution of the one or more software modules, comprises traversing a page table that defines a virtual-to-physical memory mapping for a processor or conducting an analysis of operating system process tracking structures.
17. The system of claim 14 , wherein the enumerating of the first physical page, upon execution of the one or more software modules, comprises comparing byte strings contained in the first piece of analyzed software code being a binary executable.
18. The system of claim 14 , wherein the detecting of the write to the first physical page, upon execution of the one or more software modules, comprises tracking a memory address associated with the first physical page that is written to by the first piece of analyzed software code operating in the virtual machine.
19. The system of claim 14 , wherein the detecting of the write to the first physical page, upon execution of the one or more software modules, occurs after de-obfuscation a second piece of the analyzed software code that correspond to the first piece of analyzed software code.
20. The system of claim 14 , wherein the introspection of the virtual machine comprises utilizing a library to read memory allocated for use by the virtual machine.