Storage Mirroring for BareMetal Malware Analysis on FPGA Devices Malware continue to be a major security threat for computer systems. Due to their fastgrowing number and increasing complexity, automated analysis methods are preferred by security analysts over manual ones. The automated dynamic analysis of malware executes the samples in controlled environments and monitors their potentially malicious behavior. Modern malware can detect these emulated or virtualized environments and suspend their malicious activities to foil the analysis. Consequently, the ultimate technique for analyzing the behavior of malware is through execution of the samples in bare metal analysis environments. Detection aside, restoring the analysis system to a clean state after each analysis is challenging. To resolve this, in this paper we propose an FPGAimplemented storage mirroring technique for instantaneous restoration of the storage device and the retrieval of the files having been modified during the sample execution.

BAHK: Flexible Automated Binary Analysis Method with the Assistance of Hardware and System Kernel To protect core functions, applications often utilize the countermeasure techniques such as antidebugging to avoid analysis by outsiders, especially the malware. Dynamic binary instrumentation is commonly used in the analysis of binary programs. However, it can be easily detected and has stability and applicability problems as it involves program rewriting and justintime compilation. This paper proposes a new lightweight analysis method for binary programs with the assistance of hardware features and the operating system kernel, named BAHK, which can automatically analyze the target program by stealth and has wide applicability. With the support of underlying infrastructures, this paper designs several optimization strategies and specific analysis approaches at instruction level to reduce the impact of finegrained analysis on the performance of target program so that it can be well applied in practice. The experimental results show that the proposed method has good stealthiness, low memory consumption, and positive user experience. In some cases, it shows better analysis performance than the traditional dynamic binary instrumentation method. Finally, the real case studies further show its feasibility and effectiveness.