A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing

Area of Science:

• Computer Science
• Cybersecurity
• Software Engineering

Background:

• Internet of Things (IoT) devices are increasingly targeted by sophisticated Linux malware.
• Malware employs advanced evasion techniques, complicating analysis and detection.
• Hardware tracers like Arm's Embedded Trace Microcell (ETM) offer artifact-free, low-overhead solutions for malware analysis.

Purpose of the Study:

• To develop an efficient, automated method for detecting debugger-detection routines in Linux malware.
• To leverage the ETM hardware tracer for analyzing evasive malware behavior.
• To automatically identify and patch debugger-detection mechanisms within compiled binary code.

Main Methods:

• Reconstructing the execution flow of compiled binary code from ETM trace data.
• Comparing execution traces generated with and without a debugger to identify evasion routines.
• Implementing the detection and patching scheme as a Ghidra plug-in.
• Validating the method against 15 known debugger-detection techniques in Arm-Linux environments.

Main Results:

• Successfully detected and analyzed debugger-detection routines in various Linux malware samples.
• Demonstrated effectiveness on the Mirai malware.
• Validated the approach on 423 real-world malware samples, confirming its practical applicability.
• The ETM-based method proved efficient and accurate in identifying evasive malware tactics.

Conclusions:

• The proposed ETM-based method provides an effective and automated solution for detecting and neutralizing debugger-evasion techniques in Linux malware.
• This approach significantly enhances the analysis of sophisticated and evasive malware.
• The Ghidra plug-in implementation offers a practical tool for cybersecurity researchers and analysts.