This repository contains different results for the TRM (The Reversing Machine) paper.

This directory contains compilations of example codes using different compilers and architecture (x86, x64).

The compilers are listed below:

This directory contains code that uses different functions/methods for allocating memory.

This directory contains different implementations of malware evasion techniques (Using an obfuscated version of mimikatz).

***: Discussed comprehensively in the paper.

The implementation of the proposed Longest Common Memory Address Pattern (LCMAP) algorithm, discussed in the paper.

function findLCMAP(P, P', tau)
    input:
        P   // First memory address pattern
        P'  // Second memory address pattern
        tau // Memory alignment threshold
    output:
        Result // LCMAP of the input patterns

    m, n <- len(P), len(P')           // Sizes of the input patterns
    D <- zeros(m, n)                        // Initialize m x n zero matrix

    for i from 1 to m do
        for j from 1 to n do
            if near(P[i-1], P'[j-1], tau) then
                D[i, j] <- D[i-1, j-1] + 1  // Signature matched
            else
                D[i, j] <- 0                // Signature not matched

    L <- max(D)                             // Length of the LCMAP
    I <- min{i | D[i, j] = L}               // Tail address of the LCMAP
    Result <- [P[I-L+1], ..., P[I]]         // The LCMAP
    return Result

This directory contains an example of a reconstructed kernel-mode structure (nt!_EPROCESS) along with the actual structure retrieved from the Microsoft public symbol server.

This directory contains the source of the memory access sequence interpreter (based on logs gathered from TRM).