A Heuristic Approach to Detect Opaque Predicates that Disrupt Static Disassembly

Abstract

Opaque predicates are used to perform code obfuscation by injecting superfluous branches into the program. Superfluous branches are the gateways for junk bytes or unreachable code to inconspicuously mingle with authentic code instructions. In this paper, we focus on the case where opaque predicates introduce junk bytes, thus causing damage to the static disassembly process when junk bytes are also treated as code. Although introduced two decades ago, detecting opaque predicates is still an unsolved problem due to the flexibility in their constructions. Past works on detecting opaque predicates only detect opaque predicates with specific constructions. We propose a novel approach to opaque predicates detection that allows us to generically detect opaque predicates when the damage is the inserted junk bytes. Our proposed approach is the first to detect opaque predicates by identifying their corresponding superfluous branches through the damage caused by the obfuscation. Preliminary experiments show the potential of this novel approach by detecting opaque predicates of varied constructions.