Defeating the Transparency Feature of DBI

This course teaches techniques to break the transparency feature of popular dynamic binary instrumentation (DBI) tools like DynamoRIO and PIN. Students will learn how to detect and differentiate behaviors when running on native hosts, with DBI, and on virtual machines using specially crafted X86 instruction sequences. The course covers position independent NOP sequences to evade detections and explores different types of X86 decoders. The intended audience for this course includes cybersecurity professionals, malware analysts, and individuals interested in program analysis and manipulation.