The first steps in analyzing defensive malware are understanding what obfuscations are
present in real-world malware binaries, how these obfuscations hinder analysis, and how …

Binary rewriting is changing the semantics of a program without having the source code at
hand. It is used for diverse purposes, such as emulation (eg, QEMU), optimization (eg …

The aim of this chapter is to act as a primer for those wanting to learn about Runtime
Verification (RV). We start by providing an overview of the main specification languages …

Despite decades of sustained effort, memory corruption attacks continue to be one of the
most serious security threats faced today. They are highly sought after by attackers, as they …

Mobile malware threats have recently become a real concern. In this paper, we evaluate the
state-of-the-art commercial mobile antimalware products for Android and test how resistant …

The wide adoption of non-executable page protections in recent versions of popular
operating systems has given rise to attacks that employ return-oriented programming (ROP) …

Malware attacks necessitate extensive forensic analysis efforts that are manual-labor
intensive because of the analysis-resistance techniques that malware authors employ. The …

As reverse engineering becomes a prevalent technique to analyze malware, malware
writers leverage various anti-reverse engineering techniques to hide their code. One …

Static binary rewriting is a core technology for many systems and security applications,
including profiling, optimization, and software fault isolation. While many static binary …

The Dyninst binary instrumentation and analysis framework distinguishes itself from other
binary instrumentation tools through its abstract, machine independent interface; its …