Malware Code Coverage Project

• Malware Code Coverage Project
  • Abstract
  • Requirements
    • Settings
  • Run command

Abstract

When you run a sample, you're running about 30-40% of its code on average. This comes often attributed to the fact that there are many alternative basic blocks in each function, all error conditions, exceptions, etc. But from this number it is not really clear if the execution is being lost large monolithic chunks of code. We implemented a more fine-grained measure of coverage, after instrumenting to capture the executed basic-blocks, we compared against all code in memory intelligently.

Requirements

pip install -r requirements.txt

Settings

• Set environment variable GHIDRA_INSTALL_DIR as directory where Ghidra is installed
• Compile nucleus using make
• For each minidump, also a trace and the binary must be provided, all with same name
• The three files should be named as <sample_name>.dmp, <sample_name>.bbl and <sample_name>

Run command

python coverage.py <minidump_file>