An Analysis Tool that Detects The Code Caves in Specified Sizes for Portable Executable Files

Ugurlu G., AÇICI K.

5th International Conference on Theoretical and Applied Computer Science and Engineering (ICTASCE), İstanbul, Türkiye, 29 Eylül - 01 Ekim 2022, ss.38-41, (Tam Metin Bildiri) identifier identifier

  • Yayın Türü: Bildiri / Tam Metin Bildiri
  • Doi Numarası: 10.1109/ictacse50438.2022.10009843
  • Basıldığı Şehir: İstanbul
  • Basıldığı Ülke: Türkiye
  • Sayfa Sayıları: ss.38-41
  • Ankara Üniversitesi Adresli: Evet

Özet

Code caves represent sequential null bytes in portable executable files and are particularly used in reverse engineering. With the help of code caves, the execution flow of the program can be changed, and different codes can be injected into the compiled programs. In the sections in the PE files, it is determined manually whether there is a code cave suitable for the size of the code to be injected. This paper presents the analysis tool named CodeCaveFinder. It finds in detail whether the code caves of the user desired size are in the sections of the PE file. As a result of tests, it has been proven that CodeCaveFinder gives accurate and reliable results.