Leave It to Weaver
William Mahoney, Joseph Franco, Greg Hoff, J. Todd McDonald · 2018
Malware authors make use of several techniques to obfuscate code from reverse engineering tools such as IdaPro. Typically, these techniques tend to be effective for about three to six instructions, but eventually the tools can properly disassemble the remaining code once the tool is again synchronized with the operation codes. But this loss of synchronization can be used to hide information within the instructions -- steganography. Our research explores an approach to this by presenting "Weaver", a framework for executable steganography. "Weaver" differs from other techniques in how it hides malicious instructions: the hiding instructions are prepared by generating an assembly listing of the program and finding candidate hiding locations, the steganography instructions are prepared by creating an assembly listing of the program to obtain the operation codes to be hidden, and the "weaving" process merges the two. This "weaving" attempts to place all the steganography instructions into candidate locations found in the hiding instructions.