Presentation
Emudrop: A Minimalistic, Hardware-Based Emulation Detection Approach Through Intel Reserved Opcodes
DescriptionEmulation-based dynamic analysis detects malicious software by observing runtime behavior in a controlled environment.
Malware increasingly adopts evasion techniques to recognize such environments and hide malicious activities.
In this paper, we propose EmuDRop, a minimalistic emulation-detection attack that exploits Intel reserved opcodes.
EmuDRop leverages microarchitectural differences between real hardware and emulators to identify emulated execution.
We reverse-engineer reserved opcodes, characterize their microarchitectural effects, and evaluate EmuDRop on five Intel CPU cores and QEMU, a widely used and representative emulator.
The results show that EmuDRop reliably identifies emulated environments.
Malware increasingly adopts evasion techniques to recognize such environments and hide malicious activities.
In this paper, we propose EmuDRop, a minimalistic emulation-detection attack that exploits Intel reserved opcodes.
EmuDRop leverages microarchitectural differences between real hardware and emulators to identify emulated execution.
We reverse-engineer reserved opcodes, characterize their microarchitectural effects, and evaluate EmuDRop on five Intel CPU cores and QEMU, a widely used and representative emulator.
The results show that EmuDRop reliably identifies emulated environments.
Event Type
Research Manuscript
TimeTuesday, July 2812:03pm - 12:16pm PDT
LocationMtg Room 202AB
Similar Presentations