HookTracer: A System for Automated and Accessible API Hooks Analysis
| Autor: | Golden G. Richard, Mohammad M. Jalalzai, Mingxuan Sun, Firoz-Ul-Amin, Andrew Case, Ryan D. Maggio, Aisha Ali-Gombe |
|---|---|
| Rok vydání: | 2019 |
| Předmět: |
Reverse engineering
Software_OPERATINGSYSTEMS Computer science 020207 software engineering 02 engineering and technology computer.software_genre Computer security Memory forensics Computer Science Applications Hooking ComputingMilieux_MANAGEMENTOFCOMPUTINGANDINFORMATIONSYSTEMS Medical Laboratory Technology 0202 electrical engineering electronic engineering information engineering False positive paradox Incident response Malware 020201 artificial intelligence & image processing Plug-in Law computer Argument of a function |
| Zdroj: | Digital Investigation. 29:S104-S112 |
| ISSN: | 1742-2876 |
| DOI: | 10.1016/j.diin.2019.04.011 |
| Popis: | The use of memory forensics is becoming commonplace in digital investigation and incident response, as it provides critically important capabilities for detecting sophisticated malware attacks, including memory-only malware components. In this paper, we concentrate on improving analysis of API hooks, a technique commonly employed by malware to hijack the execution flow of legitimate functions. These hooks allow the malware to gain control at critical times and to exercise complete control over function arguments and return values. Existing techniques for detecting hooks, such the Volatility plugin apihooks, do a credible job, but generate numerous false positives related to non-malicious use of API hooking. Furthermore, deeper analysis to determine the nature of hooks detected by apihooks typically requires substantial skill in reverse engineering and an extensive knowledge of operating systems internals. In this paper, we present a new, highly configurable tool called hooktracer, which eliminates false positives, provides valuable insight into the operation of detected hooks, and generates portable signatures called hook traces, which can be used to rapidly investigate large numbers of machines for signs of malware infection. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full Text from ScienceDirect