Generation of Control Flow Graph on Self-Modification Viruses

A computer virus is a well-known program that has the ability to self-replicate. When executed, a virus can copy itself into other files and perform harmful activities on the infected computer. There are many kinds of viruses, each of which has its own way of infecting other files. However, the focus of this paper is studying viruses that could change not only their data flow but also the control flow, also known as self-modification viruses. Many papers have been published on the topic of self-modifying code, and this paper specifically focuses on one technique: how a virus can modify itself by replacing its existing instructions or parts of instructions, such as opcodes, registers, flags, or addresses. By combining this technique with the Binary Emulation for Pushdown Model Generation tool (BE-PUM), we can generate the Control Flow Graph (CFG) from the binary code of a self-modification virus.