MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2
A powerful feature used in automated malware analysis is the static call graph of the executable file. Elimination of sandbox environment, fast scan, function call patterns beyond instruction level information – all of these motivate the prevalence of the feature. Processing and storing the static...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Babes-Bolyai University, Cluj-Napoca
2023-07-01
|
| Series: | Studia Universitatis Babes-Bolyai: Series Informatica |
| Subjects: | |
| Online Access: | http://193.231.18.162/index.php/subbinformatica/article/view/6349 |
| _version_ | 1797322221740359680 |
|---|---|
| author | Attila MESTER |
| author_facet | Attila MESTER |
| author_sort | Attila MESTER |
| collection | DOAJ |
| description |
A powerful feature used in automated malware analysis is the static call graph of the executable file. Elimination of sandbox environment, fast scan, function call patterns beyond instruction level information – all of these motivate the prevalence of the feature. Processing and storing the static call graph of malicious samples in a scaled manner facilitates the application of complex network analysis in malware research. IDA Pro is one of the leading disassembler tools in the industry and can generate the call graph via GenCallGdl and GenFuncGdl APIs – a tool which was used in our previous works. In this paper an alternative analysis method is presented using another disassembler tool, Radare2, an open-source Unix-based software, which is also frequently used in this domain. Radare2 has Python support (among other languages), via the r2pipe package, thus enabling full scalability on Linux-based servers using containerized solutions. This paper offers a detailed technical description on how to use Radare2 to generate the static call graph of a PE file and a thorough comparison with the output of IDA Pro, as well as a public dataset on which the experiments were carried out.
|
| first_indexed | 2024-03-08T05:11:04Z |
| format | Article |
| id | doaj.art-53bc4166532845faaf1c15cecde3afa7 |
| institution | Directory Open Access Journal |
| issn | 2065-9601 |
| language | English |
| last_indexed | 2024-03-08T05:11:04Z |
| publishDate | 2023-07-01 |
| publisher | Babes-Bolyai University, Cluj-Napoca |
| record_format | Article |
| series | Studia Universitatis Babes-Bolyai: Series Informatica |
| spelling | doaj.art-53bc4166532845faaf1c15cecde3afa72024-02-07T10:03:29ZengBabes-Bolyai University, Cluj-NapocaStudia Universitatis Babes-Bolyai: Series Informatica2065-96012023-07-0168110.24193/subbi.2023.1.01MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2 Attila MESTER0Faculty of Mathematics and Computer Science, Babes-Bolyai University, Cluj-Napoca, Romania. Email: attila.mester@ubbcluj.ro. A powerful feature used in automated malware analysis is the static call graph of the executable file. Elimination of sandbox environment, fast scan, function call patterns beyond instruction level information – all of these motivate the prevalence of the feature. Processing and storing the static call graph of malicious samples in a scaled manner facilitates the application of complex network analysis in malware research. IDA Pro is one of the leading disassembler tools in the industry and can generate the call graph via GenCallGdl and GenFuncGdl APIs – a tool which was used in our previous works. In this paper an alternative analysis method is presented using another disassembler tool, Radare2, an open-source Unix-based software, which is also frequently used in this domain. Radare2 has Python support (among other languages), via the r2pipe package, thus enabling full scalability on Linux-based servers using containerized solutions. This paper offers a detailed technical description on how to use Radare2 to generate the static call graph of a PE file and a thorough comparison with the output of IDA Pro, as well as a public dataset on which the experiments were carried out. http://193.231.18.162/index.php/subbinformatica/article/view/6349malware analysis, static call graph, radare2, IDA Pro. 1https://www.av-test.org. |
| spellingShingle | Attila MESTER MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2 Studia Universitatis Babes-Bolyai: Series Informatica malware analysis, static call graph, radare2, IDA Pro. 1https://www.av-test.org. |
| title | MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2 |
| title_full | MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2 |
| title_fullStr | MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2 |
| title_full_unstemmed | MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2 |
| title_short | MALWARE ANALYSIS AND STATIC CALL GRAPH GENERATION WITH RADARE2 |
| title_sort | malware analysis and static call graph generation with radare2 |
| topic | malware analysis, static call graph, radare2, IDA Pro. 1https://www.av-test.org. |
| url | http://193.231.18.162/index.php/subbinformatica/article/view/6349 |
| work_keys_str_mv | AT attilamester malwareanalysisandstaticcallgraphgenerationwithradare2 |