ABSTRAK Pengemas kode biner umumnya digunakan untuk melindungi kode asli di dalamkode biner yang dapat dieksekusi sehingga terdeteksi sebagai kode berbahaya olehperangkat lunak anti-malware. Berbagai metode unpacking packed binary executabletelah dipelajari secara ekstensif, beberapa pendekatan unpacking telah diajukan.Beberapa solusi ini tergantung pada berbagai asumsi, yang dapat membatasikeefektifannya. Metode baru teknik analisis memori berbasis flux diusulkan untukmenentukan akhir fungsi pembongkaran untuk memungkinkan ekstraksi kodetersembunyi dari kode biner yang dapat dikemas. Hasil penelitian menunjukkanbahwa metode kami memberikan kinerja yang lebih baik daripada metoda sebelumnyadalam mengekstrak kode tersembunyi dari packed binary executable. Khususnyapada packed benign executable menghasilkan nilai similarity rata-rata mencapai92% bila dibandingkan dengan benign executable original sedangkan 70% sampelmalware berhasil diekstraksi dan terdeteksi sebagai unpacked.

---

ABSTRACT

Binary packer has been commonly used to protect the original code inside the binary

executables being detected as malicious code by anti-malware software. Various

methods of unpacking packed binary executables have been extensively studied,

several unpacking approaches have been proposed. Some of these solutions depends

on various assumptions, which may limit their effectiveness. A new method of

flux-based memory analysis technique is proposed to determine the end of unpacking

routine to allow hidden code extraction from the packed binary executables. Our

experiments show that our method provides better performance than previous works

in extracting the hidden code from the packed binary executable. In particular, experiments

on packed benign executable exhibit an average of 92% on similarity

compared with the original benign executable while 70% of extracted hidden code

from malware samples detected as unpacked.