Soongsil University

Jeonghyun Yi

Minho Kim

Haehyun Cho

Gwangyeol Lee

A method for a deobfuscation apparatus that deobfuscates a malicious program obfuscated using an obfuscation technique, and the deobfuscation method comprises executing the malicious program to identify and extract memory information containing a trampoline code used in the obfuscation technique, executing the trampoline code based on the memory information to classify a type of obfuscation technique of the malicious program, and deobfuscating the malicious program according to the classified obfuscation technique and generating a deobfuscation program. According to the constitution, the techniques for obfuscating OEP and IAT can be deobfuscated.

Growing community of inventors

Daejeon, South Korea

Jeonghyun Yi