Towards Transparent Debugging

Abstract

Traditional malware analysis relies on virtualization or emulation technology to run samples in a confined environment, and to analyze malicious activities by instrumenting code execution. However, virtual machines and emulators inevitably create artifacts in the execution environment, making these approaches vulnerable to detection or subversion. In this paper, we present MalT , a debugging framework that employs System Management Mode, a CPU mode in the x86 architecture, to transparently study armored malware. MalT does not depend on virtualization or emulation and thus is immune to threats targeting such environments. Our approach reduces the attack surface at the software level, and advances state-of-the-art debugging transparency. MalT embodies various debugging functions, including register/memory accesses, breakpoints, and seven stepping modes. Additionally, MalT restores the system to a clean state after a debugging session. We implemented a prototype of MalT on two physical machines, and we conducted experiments by testing an array of existing anti-virtualization, anti-emulation, and packing techniques against MalT . The experimental results show that our prototype remains transparent and undetected against the samples. Furthermore, debugging and restoration introduce moderate but manageable overheads on both Windows and Linux platforms.