At the end of January I handed in my thesis
“Pandora's Bochs: Automatic Unpacking of Malware”, the last missing piece towards my graduation. It deals with building an automatic unpacker for runtime-packed PE binaries on top of the
Bochs PC Emulator. The results were encouraging, but I hit some limits with Bochs's emulation speed, and there were also other issues with advanced packers that I could not fully investigate. Other than that, Pandora's Bochs can fairly reliably create memory dumps of an unpacked process, yet automatic import recovery and OEP reconstruction fail for packers that redirect imports or use “stolen bytes” or similar techniques.
I'm planning to release Pandora's Bochs's source code once I find some time to clean it up a little.
