VMorph: A Virtualization/Metamorphic Framework for Binary Obfuscation and Intellectual Property Protection

In this paper, we analyse the effectiveness of combining obfuscation and metamorphism techniques to evade antivirus detection and protect intellectual property. We do so by introducing a new framework called VMORPH, which utilises jointly emulation and metamorphic techniques to thwart attempts at reconstructing the application’s behaviour and accessing internal details or secrets. We assess the performance of VMORPH to determine its suitability for safeguarding the intellectual property of the application. The findings indicate a decrease in performance, which is still acceptable for securing applications. Additionally, we investigate the stealth capabilities of the proposed technique, which enhances its ability to bypass common static analysis techniques. Based on the results, we also suggest detection techniques that can be employed to mitigate the risk that this technique is used to evade antivirus detection.