Obfuscation of executable code to improve resistance to static disassembly

Linn, Cullen; Debray, Saumya

doi:10.1145/948109.948149

Cited by 330 publications

(133 citation statements)

References 26 publications

Supporting

Mentioning

126

Contrasting

Unclassified

Order By: Relevance

“…Linn et al designed an obfuscation to thwart linear sweep and recursive traversal static disassembly algorithms [23], which introduced junk instructions, jump tables, and opaque predicates to disrupt the static disassembly process. Ledoux et al proposed an instruction embedding method to improve instruction overlapping obfuscation [24].…”

Section: Related Workmentioning

confidence: 99%

An Iteration Obfuscation Based on Instruction Fragment Diversification and Control Flow Randomization

Liu¹,

Xie²,

Lu³

et al. 2016

IJCTE

View full text Add to dashboard Cite

Abstract-As the control flow graph can reflect the logic structure of programs, static and dynamic reverse methods are used to analyze the logic structure and instruction sequence, and the existing methods of control flow obfuscation have low potency to resist reverse attacks. To solve this problem, we propose an obfuscation method based on instruction fragment diversification and control flow randomization, diversified instruction fragments are generated by various equivalent transformation rules, and random functions are used to select one execution path from the multi-way branches of programs, then programs are iteratively obfuscated. Experiments and analysis show that diversified instruction fragments and multi-way branches can increase the difficulty of static reverse analysis, random selection for multi-way branches will increase the difficulty of dynamic instruction tracing, and iterative transformation for many times enhances the complexity of control flow graph.Index Terms-Code obfuscation, iterative transformation, instruction fragment diversification, control flow randomization.

show abstract

Section: Related Workmentioning

confidence: 99%

An Iteration Obfuscation Based on Instruction Fragment Diversification and Control Flow Randomization

Liu¹,

Xie²,

Lu³

et al. 2016

IJCTE

View full text Add to dashboard Cite

show abstract

“…In [13], Linn and Debray introduced novel obfuscation techniques that exploit the fact that the Intel x86 instruction set architecture contains variable length instructions that can start at arbitrary memory address. By inserting padding bytes at locations that cannot be reached during run-time, disassemblers can be confused to misinterpret large parts of the binary.…”

Section: Robust Disassembly Of Obfuscated Binariesmentioning

confidence: 99%

“…Linn and Debray's approach [13] to confuse disassemblers are based on two main techniques. First, junk bytes are inserted at locations that are not reachable at run-time.…”

Section: Robust Disassembly Of Obfuscated Binariesmentioning

confidence: 99%

“…In fact, the obfuscation techniques introduced by Linn and Debray [13] precisely exploit the fact that standard disassemblers assume certain properties of compiler-generated code that can be violated without changing the program's functionality. However, in general, certain properties are easier to change than others and it is not straightforward to transform a binary into a functionally equivalent representation in which all the compiler-related properties of the original code are lost.…”

Section: Robust Disassembly Of Obfuscated Binariesmentioning

confidence: 99%

“…Overlapping instructions have been suggested to complicate disassembly in [5]. However, suitable candidate instructions for this type of transformation are difficult to find in real executables and the reported obfuscation effects were minimal [13].…”

Section: Robust Disassembly Of Obfuscated Binariesmentioning

confidence: 99%

See 2 more Smart Citations

Static Disassembly and Code Analysis

Vigna

Advances in Information Security

View full text Add to dashboard Cite

Summary. The classification of an unknown binary program as malicious or benign requires two steps. In the first step, the stream of bytes that constitutes the program has to be transformed (or disassembled) into the corresponding sequence of machine instructions. In the second step, based on this machine code representation, static or dynamic code analysis techniques can be applied to determine the properties and function of the program.Both the disassembly and code analysis steps can be foiled by techniques that obfuscate the binary representation of a program. Thus, robust techniques are required that deliver reliable results under such adverse circumstances. In this chapter, we introduce a disassemble technique that can deal with obfuscated binaries. Also, we introduce a static code analysis approach that can identify high-level semantic properties of code that are difficult to conceal.

show abstract

A software protection method based on instruction camouflage

Kanzaki

Monden

Nakamura

et al. 2005

Electron. Comm. Jpn. Pt. III

View full text Add to dashboard Cite

SUMMARYThis paper presents a method in which program analysis by a malicious user (attacker) is made difficult by camouflaging (hiding) a large number of instructions contained in the program. In the proposed method, an arbitrary instruction (target) in the program is camouflaged by a different instruction. Using the self-modification mechanism in the program, the original instruction is restored only in a certain period during execution. Even if the attacker attempts an analysis of the range containing the camouflaged instruction, it is impossible for him to correctly understand the original behavior of the program unless he notices the existence of the routine that rewrites the target (restoring routine). In order to make the analysis a success, the range containing the restoring routine must be analyzed, and the attacker is forced to analyze a wider range of the program. The proposed method can easily be automated, and the number of targets can be specified arbitrarily according to the required degree of protection and the acceptable degradation of execution efficiency.

show abstract

Obfuscation of executable code to improve resistance to static disassembly

Cited by 330 publications

References 26 publications

An Iteration Obfuscation Based on Instruction Fragment Diversification and Control Flow Randomization

An Iteration Obfuscation Based on Instruction Fragment Diversification and Control Flow Randomization

Static Disassembly and Code Analysis

A software protection method based on instruction camouflage

Contact Info

Product

Resources

About