Fighting malware and spam

Automatic rules-based binary analysis with IDA Pro and CLIPS

Ryan Hicks AVG

IDA Pro is the premier disassembler used by reverse-engineering and malware analysis specialists. CLIPS is a highly regarded expert system available in the public domain. These two tools combined can produce a means of automatically analysing binary files that can greatly speed up the sample intake and classification process, thus reducing researcher workload.

The makers of IDA Pro provide a C++ based plug-in SDK that gives access to its internal database. This database contains disassembly information about the binary under analysis. By feeding this information into a CLIPS knowledge base, it is possible to determine the disposition of samples.

First, this paper this will give an overview of the IDA Pro SDK, CLIPS, and the steps necessary to connect the two. Next, it will show which IDA Pro database structures are of interest to malware researchers and how to create CLIPS rules that are of use in analysing binaries in a malware research context. Lastly, usage hints and sample code will be provided.