System and method for programmatic runtime de-obfuscation of obfuscated software utilizing virtual machine introspection and manipulation of virtual machine guest memory permissions

A computerized method for performing runtime de-obfuscation of obfuscated malicious software code in a virtual machine, the method comprising:

• providing a virtual address space and a virtual-to-physical address mapping for use in execution of a first piece of software code, the virtual address space being a portion of a virtual address space associated with the virtual machine;
• during runtime of the virtual machine, updating the virtual address space and the virtual-to-physical address mapping in response to at least (i) a process change, (ii) a change of software code being analyzed, or (iii) a change in at least one page table associated with the virtual-to-physical address mapping, and
• performing, via virtual machine introspection, runtime de-obfuscation of the first piece of software code being analyzed including
• (i) detecting when a first virtual location in the first virtual address space was written to and, subsequently, software code at the first virtual location was executed, wherein the first virtual location corresponds to a first physical location in the first physical page having a permission of non-writable, and
• (ii) determining that the software code at the first virtual location corresponds to obfuscated software code.

A system comprising:

• a processor;
• and
• a storage medium communicatively coupled to the processor, the storage medium includes one or more software modules that, upon execution by the processor, perform operations that comprise
• enumerating at least a first physical page corresponding to a first virtual address space of software code under analysis, the analysis occurring during runtime within the virtual machine, the first virtual address space being a first portion of a virtual address space associated with the virtual machine;
• setting a permission of the first physical page to a non-writable permission, wherein the first physical page resides outside of the virtual machine;
• performing, via virtual machine introspection, runtime de-obfuscation of the software code under analysis including
• (i) tracking locations in the first virtual address space that are written to during analysis,
• (ii) tracking locations in the first virtual address space at which an instruction of the software is executed during analysis, and
• (iii) detecting when a first virtual location in the first virtual address space was written to and an instruction located at the first virtual location is executed, wherein the first virtual location corresponds to a first physical location in the first physical page having a permission of non-writable;
• and
• responsive to detecting the first virtual location was written to and the instruction located at the first virtual location is executed, determining that the instruction at the first virtual location corresponds to obfuscated software code.