Abstract-In order to increase their stealth, malware commonly use the self-modification property of programs. By doing so, programs can hide their real code so that it is difficult to define a signature for it. But then, what is the meaning of those programs: the obfuscated form, or the hidden one? Furthermore, from a computability perspective, it becomes hard to speak about the program since, its own code varies over time. To cope with these issues, we provide an operational semantics for self-modifying programs and we show that they can be constructively rewritten to a non-modifying program.
An operational semantics is defined in REF , where a rewriting process from self-modifying programs to non-modifying programs is defined.
A Computability Perspective on Self-Modifying Programs
2009 Seventh IEEE International Conference on Software Engineering and Formal Methods
2009 Seventh IEEE International Conference on Software Engineering and Formal Methods
Computer Science