Spike: Engineering malware analysis tools using unobtrusive binaryinstrumentation

Malware — a generic term that encompasses viruses, trojans, spywares and other intrusive code — is widespread today. Malware analysis is a multi-step pro-cess providing insight into malware structure and func-tionality, facilitating the development of an antidote. Behavior monitoring, an important step in the analy-sis process, is used to observe malware interaction with respect to the system and is achieved by employing dy-namic coarse-grained binary-instrumentation on the tar-get system. However, current research involving dy-namic binary-instrumentation, categorized into probe-based and just-in-time compilation (JIT), fail in the con-text of malware. Probe-based schemes are not transpar-ent. Most if not all malware are sensitive to code mod-ification incorporating methods to prevent their analy-sis and even instrument the system themselves for their functionality and stealthness. Current JIT schemes, though transparent, do not support multithreading, self-modifying and/or self-checking (SM-SC) code and are unable to capture code running in kernel-mode. Also, they are an overkill in terms of latency for coarse-grained instrumentation. To address this problem, we have developed a new dynamic coarse-grained binary-instrumentation frame-work codenamed SPiKE, that aids in the construction of powerful malware analysis tools to combat malware that are becoming increasingly hard to analyze. Our goal is to provide a binary-instrumentation framework that is unobtrusive, portable, efficient, easy-to-use and reusable, supporting multithreading and SM-SC code, both in user- and kernel-mode. In this paper, we dis-cuss the concept of unobtrusive binary-instrumentation and present the design, implementation and evaluation of SPiKE. We also illustrate the framework utility by describing our experience with a tool employing SPiKE to analyze a real world malware