Kernel-mode Software Protection Vulnerability Assessment and Rootkit Reverse Engineering Tool Development

The Air Force Research Lab's Software Protection Initiative has a mission to prevent unauthorized distribution and exploitation of application software critical to national security. That mission has led to investment to develop advanced software protections, including the use of rootkit-like methods that provide anti-piracy and anti-reverse engineering protection critical to software applications. Malicious attackers use rootkit technology to hide their presence and behaviors on compromised computer systems. Gaining better understanding of the tactics and techniques of malicious rootkit users will assist in the development of better detection capabilities and countermeasures for those attacks as well as assist AT-SPI to enhance the protection strength of its kernel-mode software protection technologies. HBGary proposes to develop a Software Protection Analyzer ("SPA") with a Kernel Virtual Machine to detect, analyze and assess the types of software protection employed on a system and to assist engineers who are attempting to reverse engineer such mechanisms. The SPA will probe volatile memory to identify hidden or protected software. The system will analyze the defense mechanisms that the software employs and generate a report of its findings. It will also facilitate tracing and recovery of kernel and protected software and its defenses against reverse engineering.