Analysis of Anti-Reversing Functionalities of VMProtect and Bypass Method Using Pin


KIPS Transactions on Computer and Communication Systems, Vol. 10, No. 11, pp. 297-304, Nov. 2021
https://doi.org/10.3745/KTCCS.2021.10.11.297,   PDF Download:
Keywords: Reverse engineering, Dynamic Analysis, Protector, Pin
Abstract

Commercial obfuscation tools (protectors) aim to create difficulties in analyzing the operation process of software by applying obfuscation techniques and Anti-reversing techniques that delay and interrupt the analysis of programs in software reverse engineering process. In particular, in case of virtualization detection and anti-debugging functions, the analysis tool exits the normal execution flow and terminates the program. In this paper, we analyze Anti-reversing techniques of executables with Debugger Detection and Viralization Tools Detection options through VMProtect 3.5.0, one of the commercial obfuscation tools (protector), and address bypass methods using Pin. In addition, we predicted the location of the applied obfuscation technique by finding out a specific program termination routine through API analysis since there is a problem that the program is terminated by the Anti-VM technology and the Anti-DBI technology and drew up the algorithm flowchart for bypassing the Anti-reversing techniques. Considering compatibility problems and changes in techniques from differences in versions of the software used in experiment, it was confirmed that the bypass was successful by writing the pin automation bypass code in the latest version of the software (VMProtect, Windows, Pin) and conducting the experiment. By improving the proposed analysis method, it is possible to analyze the Anti-reversing method of the obfuscation tool for which the method is not presented so far and find a bypass method.


Statistics
Show / Hide Statistics

Statistics (Cumulative Counts from September 1st, 2017)
Multiple requests among the same browser session are counted as one view.
If you mouse over a chart, the values of data points will be shown.


Cite this article
[IEEE Style]
S. Park and Y. Park, "Analysis of Anti-Reversing Functionalities of VMProtect and Bypass Method Using Pin," KIPS Transactions on Computer and Communication Systems, vol. 10, no. 11, pp. 297-304, 2021. DOI: https://doi.org/10.3745/KTCCS.2021.10.11.297.

[ACM Style]
Seongwoo Park and Yongsu Park. 2021. Analysis of Anti-Reversing Functionalities of VMProtect and Bypass Method Using Pin. KIPS Transactions on Computer and Communication Systems, 10, 11, (2021), 297-304. DOI: https://doi.org/10.3745/KTCCS.2021.10.11.297.