Defeating MBA-based Obfuscation

Abstract

International audienceMixed Boolean-Arithmetic expressions are presented as a strong protection in the context of data flow obfuscation. As there is very little literature on the analysis of such obfus-cated expressions, two important subjects of interest are: to define what simplifying those expressions means, and how to design a simplification solution. We focus on evaluating the resilience of this technique, by giving theoretical elements to justify its efficiency and proposing a simplification algorithm using a pattern matching approach. The implementation of this solution is capable of simplifying the public examples of MBA-obfuscated expressions, demonstrating that at least a subset of MBA obfuscation lacks resilience against pattern matching analysis

How to kill symbolic deobfuscation for free (or: unleashing the potential of path-oriented protections)

“…Biondi et al [11] propose an obfuscation based on Mixed Boolean-Arithmetic expressions [50] to complexify points-to functions, making it harder for solvers to determine the trigger. Eyrolles et al [27] present a similar obfuscation together with a MBA expression simplifier based on pattern matching and arithmetic simplifications. Cryptographic hash functions hinder current solvers and can replace MBA [40].…”

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

“…This leads to a possible pattern matching attack (i.e. dictionary attack) [16], where one takes obfuscated predicates from a program being attacked and pattern-matches the source code against known examples. Nevertheless, it is possible to build variants of opaque predicates that cannot be matched using dictionary attacks, which implies a high false negative rate.…”

“…As a consequence, several works focus on the deobfuscation of opaque predicates (e.g. [5,7,8,16,29,32,42]) in order to evaluate the quality of the obfuscated code rendered by this transformation. However, these techniques are often based on dynamic analysis and are therefore limited or not scalable.…”

Formal verification of a program obfuscation based on mixed Boolean-arithmetic expressions

“…Algorithm MBA-Obf (e, d, n, R) loop d times { choose an operator op of e rewrite op with a rewrite rule r in R choose 2 n-bit values for coefficients a and b of the affine function f while a non-invertible module 2^n choose another a compute 1/a and -b/a, the coefficients of the inverse of f insert affine composition around the rewritten operator } Figure 1. Main algorithm (borrowed from [10]): obfuscation of an expression e, given a degree of obfuscation d, a number of bits n, a set of rewrites rules R.…”