1. Steganography for Executables and Code Transformation Signatures Bertrand Anckaert, Bjorn De Sutter, Dominique Chanet and Koen De Bosschere

2. 2 Problem Alice Bob Wendy Embedder Extractor

3. 3 Location of the Secret Message oMedia human senses redundant bits oExecutables processors single-bit failure NOISE ⇒ CHOICE

4. 4 01 Embedding Bits in a Choice 00011011

5. 5 Embedding Bits in a Choice 5 4 3 2 1 0 12481632 alternatives bitsbits n=7 ⇒ 3 unused n=31 ⇒ 15 unused

6. 6 00011000011011 00001010011001011101 Embedding Bits in a Choice

7. 7 5 4 3 2 1 0 12481632 alternatives bitsbits

8. 8 Instruction Selection Alice Bob Selection

9. 9 Instruction Selection mov 0,reg sub reg,reg and 0,reg xor reg,reg lea 0,reg imul 0,reg operation: reg=0 sub -1,reg add 1,reg inc reg lea 1(reg),reg operation: reg=reg+1 … neg reg imul -1,reg,reg operation: reg=-reg

10. 10 Alice Bob Scheduling Selection Scheduling Selection

11. 11 Instruction Scheduling & Code Layout source sink oInstruction Scheduling oCode Layout pieces of code that can be placed in any order

12. 12 Layout Interactions Alice Bob Scheduling Selection Layout Scheduling Selection Canonicalize

13. 13 Evaluation: i386 (1) bzip2craftygapgzipmcfparsertwolfvortexvprtotal 0.000 (1/200) 0.005 (1/100) 0.010 0.015 (1/50) 0.020 (1/40) 0.025 0.030 0.035 (1/25) 0.040 instruction selection instruction scheduling code layout Benchmarks Embedding Rate Hydan

14. 14 Layout Code Transformation Signatures Alice Bob Scheduling Selection Layout Scheduling Selection Wendy sub 0x8,ebp (3 byte) ⇒ lea -0x8(,ebp,1),ebp (7byte)

15. 15 CTS: Instruction Selection mov 0,reg sub reg,reg and 0,reg xor reg,reg lea 0,reg imul 0,reg operation: reg=0 Wendy

16. 16 oCTS: unusual code property introduced by the applied code transformation oDetection: 1.quantify property through metric 2.build statistical model of expected behavior 3.compare observed to expected behavior 4.classify code into clean and suspect Detection of CTSs

17. 17 Layout Code Transformation Signatures Scheduling Selection Unusual Instructions Unusual Frequencies Diverse Schedules Suboptimal Schedules Unusual Jump Behaviour

18. 18 Evaluation: i386 (2) instruction selection instruction scheduling code layout bzip2craftygapgzipmcfparsertwolfvortexvprtotal Benchmarks 0.000 (1/200) 0.005 (1/100) 0.010 0.015 (1/50) 0.020 (1/40) 0.025 0.030 0.035 (1/25) 0.040 Embedding Rate Hydan

19. Questions?