## 4 Related Work  
In this section, we describe related work and compare it with our methodology, which addresses the problem of decrypting malware output files in a general way as opposed to what is found in the literature that often targets the automatic detection of cryptographic algorithms and related parameters, employing static or dynamic methods. This means these techniques and tools can be used in specific steps of our methodology and therefore it is valuable to know them. [PERSON] _et al_. introduce in [26] a system called ReFormat, which can be used to automatically reverse engineer encrypted messages that are part of known or unknown protocols. This tool needs to dynamically instrument the target program, in order to collect a trace of the instructions that operate over encrypted data. The main assumption of their approach is that most of the instructions of a decryption routine perform arithmetic and bitwise operations. Therefore, by analyzing the rate of these instructions in the execution trace, one can pinpoint the code that implements cryptographic algorithms, and, the memory region containing the decrypted message. Limitations of ReFormat include the inability to work with obfuscated programs and the ones that decrypt messages in several steps. The tool created by [PERSON] _et al_. [27], called Dispatcher, also focuses on automatic protocol reverse engineering, extending [PERSON]'s aforementioned paper. The first improvement of their work over the latter consists in identifying in a program every piece of code that implements cryptographic operations, by removing the assumption that decryption and consumption processes must be completely linear. In order to flag those regions, the tool considers functions of at least 20 instructions, which present a ratio between the number of arithmetic and bitwise instructions over the total that is greater than 0.55. Other enhancement presented by Dispatcher is the ability to identify buffers containing plaintext used by both encryption and decryption processes. The evaluation of these techniques were performed over a Mega-D botnet [28] execution traces and an Apache HTTPS session, resulting in successful identification of all cryptographic routines. Another dynamic analysis method for identifying cryptographic primitives is presented by [PERSON] _et al_. in [29]. In the first stage, their technique uses the dynamic binary instrumentation framework Pin [30] to collect an execution trace of the target program, including memory addresses manipulated by it. After that, three heuristics are employed in order to pinpoint cryptographic code inside the trace: (i) Chains--compares sequences of instructions, no matter the operands, against a database of signatures created from open source cryptosystem implementations; (ii) Mnemonic-Const--extends the Chains heuristic by also taking into consideration typical constants that are used with the instructions in those reference implementations; and (iii) Verifier--based on possible key, \(k\), plaintext, \(m\), and ciphertext, \(c\), obtained from the memory reconstruction mechanism they describe, uses a reference implementation of the candidate algorithm to test if it is possible to get \(c\) by encrypting \(m\) with \(k\). An interesting solution that works with obfuscated programs as well as unprotected ones is described by [PERSON] _et al_. in [31]. They propose a tool called Aligot, also based on Pin framework, which is able to identify several symmetric cryptosystems, such as MD5 and AES. As usual in dynamic analysis, Aligot starts collecting an execution trace of the target program, from which it detects loops, assuming that they contain the cryptographic operations, and I/O parameters resulting from the use of cryptography. Finally, the extracted values are compared with reference implementations of cryptosystems, by verifying if thesame output can be calculated from the candidate inputs.