Skip to main content

Building a mutation tool for binaries: expanding a dynamic binary rewriting tool to obfuscate malwares

New malware are created every day. However, some are just previously known ones, altered to make them invisible to classifiers. But how can a classifier defend itself against them? Malware mutation tools are developed to help classifiers and to prevent potential malware from accessing a computer. However, these mutators are static, and no dynamic mutation tool exists. The goal of this work is to create dynamic mutation tools using a dynamic binary lifter and recompiler; BinRec. BinRec is the only tool capable of dynamically lifting a binary, applying optimizations, and recovering the binary. We will explain in detail how this tool works, and how we use it. We'll be looking at the 11 different mutation types we have developed, then evaluate each one of them in order to see how well they can change a binary. Finally, we suggest other mutations to be implemented to further mutate the binaries.