Anatomy of Exploit Code in Non-Executable Files using Virtualization

In this paper, we propose a methodology for detecting and analyzing the exploit code in nonexecutable files using virtualization. It is difficult to detect and analyze the exploit code in a non-executable file because the code and real data are mixed in the file. We trace the execution flow of the target software system while parsing the file, and start to analyze the exploit code when the execution flow strays outside of normal modules. The normal module region is the region that the target software system executes normally. By extracting the exploit code from the nonexecutable file, signatures for detecting the nonexecutable material, including the exploit code, can begenerated.