Evaluating Dynamic Binary Instrumentation Systems for Conspicuous Features and Artifacts

Dynamic binary instrumentation (DBI) systems are a popular solution for prototyping heterogeneous program analyses and monitoring tools. Several works from academic practitioner venues have questioned the transparency of DBI systems, with anti-analysis detection sequences being found already in malware executable protectors. The present Field Note details new established methods evaluates recent versions against them. It also sets out reflections on potential remediations alternatives available to security researchers their daily needs. We make large collection implemented detections, hoping it can help community build better runtimes