DeRop: Removing return-oriented programming from malware

Kangjie Lu, Dabi Zou, Weiping Wen, Debin Gao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

10 Scopus citations


Over the last few years, malware analysis has been one of the hottest areas in security research. Many techniques and tools have been developed to assist in automatic analysis of malware. This ranges from basic tools like disassemblers and decompilers, to static and dynamic tools that analyze malware behaviors, to automatic malware clustering and classification techniques, to virtualization technologies to assist malware analysis, to signature- and anomaly-based malware detection, and many others. However, most of these techniques and tools would not work on new attacking techniques, e.g., attacks that use return-oriented programming (ROP). In this paper, we look into the possibility of enabling existing defense technologies designed for normal malware to cope with malware using return-oriented programming. We discuss difficulties in removing ROP from malware, and design and implement an automatic converter, called deRop, that converts an ROP exploit into shellcode that is semantically equivalent with the original ROP exploit but does not use ROP, which could then be analyzed by existing malware defense technologies. We apply deRop on four real ROP malwares and demonstrate success in using deRop for the automatic conversion. We further discuss applicability and limitations of deRop.

Original languageEnglish (US)
Title of host publicationProceedings - 27th Annual Computer Security Applications Conference, ACSAC 2011
Number of pages10
StatePublished - 2011
Event27th Annual Computer Security Applications Conference, ACSAC 2011 - Orlando, FL, United States
Duration: Dec 5 2011Dec 9 2011

Publication series

NameACM International Conference Proceeding Series


Other27th Annual Computer Security Applications Conference, ACSAC 2011
Country/TerritoryUnited States
CityOrlando, FL


  • Malware analysis
  • Return-oriented programming


Dive into the research topics of 'DeRop: Removing return-oriented programming from malware'. Together they form a unique fingerprint.

Cite this