Skip to main content
Article
Metamorphic code generation from LLVM bytecode
Journal of Computer Virology and Hacking Techniques (2013)
  • Teja Tamboli, San Jose State University
  • Thomas H. Austin, San Jose State University
  • Mark Stamp, San Jose State University
Abstract

Metamorphic software changes its internal structure across generations with its functionality remaining unchanged. Metamorphism has been employed by malware writers as a means of evading signature detection and other advanced detection strategies. However, code morphing also has potential security benefits, since it can serve to increase the “genetic diversity” of software. We have created a metamorphic code generator within the LLVM compiler framework. LLVM is a three-phase compiler that supports multiple source languages and target architectures. It uses a common intermediate representation (IR) bytecode in its optimizer. Consequently, any supported high-level programming language is transformed to this IR bytecode as part of the LLVM compilation process. Our metamorphic generator functions at the IR bytecode level, which provides many advantages over morphing at the assembly or source code level. The morphing techniques that we employ include dead code insertion and transposition, where the dead code is actually executed within the morphed code, making its detection and removal more challenging. We have verified the effectiveness of our code morphing using hidden Markov model analysis.

Keywords
  • Hacking techniques,
  • computer virology,
  • computer science,
  • electronics,
  • IT,
  • Software,
  • Telecommunications
Disciplines
Publication Date
2013
Publisher Statement
SJSU users: use the following link to login and access the article via SJSU databases
Citation Information
Teja Tamboli, Thomas H. Austin and Mark Stamp. "Metamorphic code generation from LLVM bytecode" Journal of Computer Virology and Hacking Techniques Vol. 10 Iss. 3 (2013)
Available at: http://works.bepress.com/thomas_austin/1/