title: ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Automation of executable file analysis using symbolic execution
Creators: name: Ð¨ÑÐ»ÑÑÐµÐ², ÐÐ»ÑÑ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ðµ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ðµ
Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð·
ÑÑÐ»Ð¾Ð²Ð¸Ñ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ
symbolic execution
automated analysis
execution conditions

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼Ð¾Ð³Ð¾ ÑÐ°Ð¹Ð»Ð° Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸ÑÂ». Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð¿Ð¾Ð¸ÑÐºÐ° ÑÑÐ»Ð¾Ð²Ð¸Ð¹ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð¾Ð¿Ð°ÑÐ½ÑÑ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ñ, Ð¼ÐµÑÐ¾Ð´Ñ Ð¸ ÑÑÐµÐ´ÑÑÐ²Ð° ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ, Ð¿ÑÐ¸Ð¼ÐµÐ½Ð¸Ð¼ÑÐµ Ð´Ð»Ñ Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ñ Ð²Ð½ÐµÑÐ½Ð¸Ñ Ð´Ð°Ð½Ð½ÑÑ Ð¿ÑÐ¸ Ð¿Ð¾Ð¸ÑÐºÐµ Ð¿Ð¾ÑÐµÐ½ÑÐ¸Ð°Ð»ÑÐ½Ð¾ Ð¾Ð¿Ð°ÑÐ½ÑÑ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÐ½Ð°Ð»Ð¸Ð· ÑÑÐµÐ´ÑÑÐ² ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð¸ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÐ¸ Ð¸Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð². 2. ÐÐ½Ð°Ð»Ð¸Ð· ÑÑÐµÐ´ÑÑÐ², Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸Ñ ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ðµ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ðµ Ð´Ð»Ñ Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ñ ÑÐ¾ÑÐ¼Ð°ÑÐ° Ð²ÑÐ¾Ð´Ð½ÑÑ Ð´Ð°Ð½Ð½ÑÑ. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ñ ÑÑÐ»Ð¾Ð²Ð¸Ð¹ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð¾Ð¿Ð°ÑÐ½ÑÑ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ Ð²Ð¾ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¼ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð¼ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ð¸ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¾Ð³Ð¾ ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° ÑÑÐµÐ´ÑÑÐ²Ð° Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ð³Ð¾ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ. 5. ÐÑÐµÐ½ÐºÐ° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð°. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÐµ ÑÑÐµÐ´ÑÑÐ²Ð°, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ¸Ðµ ÑÐ¸Ð¼Ð²Ð¾Ð»ÑÐ½Ð¾Ðµ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ðµ Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð², Ð¸Ñ Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÐ° Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð¾ ÑÐ¾Ð±ÑÑÐ²ÐµÐ½Ð½Ð¾Ðµ ÑÐµÑÐµÐ½Ð¸Ðµ, Ð¿Ð¾Ð·Ð²Ð¾Ð»ÑÑÑÐµÐµ Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÑÑÑ ÑÐ¾ÑÐ¼Ð°Ñ Ð²ÑÐ¾Ð´Ð½ÑÑ Ð´Ð°Ð½Ð½ÑÑ Ð½ÐµÐ¾Ð±ÑÐ¾Ð´Ð¸Ð¼ÑÑ Ð´Ð»Ñ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð¿Ð¾ÑÐµÐ½ÑÐ¸Ð°Ð»ÑÐ½Ð¾ Ð¾Ð¿Ð°ÑÐ½ÑÑ ÑÑÐ½ÐºÑÐ¸Ð¹. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ðµ ÑÐµÑÐµÐ½Ð¸Ðµ Ð±ÑÐ»Ð¾ Ð¿ÑÐ¾ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¾ Ð½Ð° ÑÐµÐ°Ð»ÑÐ½ÑÑ Ð¿ÑÐ¸Ð¼ÐµÑÐ°Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ.
description: The topic of the final qualifying work: Â«Automation of executable file analysis using symbolic executionÂ». The purpose of the work is to automate the search for conditions for performing dangerous actions using symbolic execution. The subject of the study is the possibility of using symbolic execution to determine external data when searching for potentially dangerous actions. Tasks to be solved during the research: 1. Analysis of symbolic execution tools and the possibility of their use for automated analysis of executable files. 2. Analysis of tools using symbolic execution to determine the format of input data. 3. Development of an algorithm for determining the conditions for performing dangerous actions in malicious software using dynamic symbolic execution. 4. Development of a tool for automated analysis of executable files based on the use of symbolic execution. 5. Evaluation of the effectiveness of the analysis of malicious files using the developed tool. In the course of the work, the tools using symbolic execution for analyzing executable files, their architecture and implementation were analyzed. A proprietary solution has been implemented that allows you to determine the format of the input data necessary to perform potentially dangerous functions. The developed solution was tested on real examples of malicious software.