Ether: Malware Analysis via Hardware Virtualization Extensions

By A. Dinaburg, P. Royal, M. Sharif and W. Lee

Proceedings of the 15th ACM Conference on Computer and Communications Security 2008 (CCS’08)

Ether is a malware analysis framework which leverages hardware virtualization extensions (specifically Intel VT) to remain transparent to malicious software. It supports both fine- (single instruction) and coarse- (system call) granularity tracing. (I’m curious what the performance penalty for the fine-grain tracing is. The authors only say that it’s “significant”.)

Both the GPL’ed source code for Ether and the paper are available for download at http://ether.gtisc.gatech.edu.

Advertisement