Show description

Dynamic objects have both a relocatable view and an executable view—shared libraries use this format. Dynamic linking is slightly different to the PE format and uses a Global Offset Table (GOT) and a stub call to the runtime linker to resolve imports. 3 Java Class File Java class files [6] contain object code in sections defined in the file’s headers. The object code is in the instruction format for execution on the Java Virtual Machine. Like the previous object file format, a sequence of marker bytes (the magic bytes) in the header identifies the file format.

Polymorphism borrows many of the techniques from the field of program obfuscation. Polymorphism is sometimes described by the similar term of metamorphism. In that usage it is used to describe the automated syntactic mutation of the malware’s code and instructions. Under such terminology, polymorphism is used to describe syntactic mutation of limited parts of the malware’s instruction content. The remaining parts of the malware are encoded at the byte level without regard to the instruction syntax or semantics.

After the restoration routine of one packing transformation has been applied, control may transfer another packed layer. The original entry point is derived from the last such layer. The process of this form of malware packing is shown in Fig. 7. 10 Shifting Decode Frame An extension to traditional code packing is to maintain as much of the packed image in an encrypted form at run-time. During execution of the malware, blocks of memory can be decrypted as needed and subsequently re-encrypted to prevent an analyst or 26 3 Program Transformations and Obfuscations Shifting Decode Frame Restoration Routine Shifting Decode Frame Restoration Routine Runtime Packing Original Code Original Code Original Executable Hidden Code = f(Original Code) Hidden Code Packed Executable Memory Image at Runtime Fig.