Semantic Analysis of Native Programs with Code Reason

Summary: Trail of Bits introduced CodeReason, a machine code analysis framework built for DARPA Cyber Fast Track that provides semantic understanding of native x86 and ARM instructions so analysts can query the effects of code on program state. The team used it to write a C string deobfuscator for Flame malware binaries posted to malware.lu, capturing the semantics of a one-basic-block function that computes a decryption modifier in eax.
What's compelling: The same deobfuscation routine the team analyzed contains a race condition: if two threads deobfuscate the same string at once, they corrupt it permanently, which could pass bad data to a system service.

Read the original at Trail of Bits Blog ↗