Replacement attacks against VM-protected applications

Abstract

Process-level virtualization is increasingly being used to enhance the security of software applications from reverse engineering and unauthorized modification (called software protection). Processlevel virtual machines (PVMs) can safeguard the application code at run time and hamper the adversary's ability to launch dynamic attacks on the application. This dynamic protection, combined with its flexibility, ease in handling legacy systems and low performance overhead, has made process-level virtualization a popular approach for providing software protection. While there has been much research on using process-level virtualization to provide such protection, there has been less research on attacks against PVM-protected software. In this paper, we describe an attack on applications protected using process-level virtualization, called a replacement attack. In a replacement attack, the adversary replaces the protecting PVM with an attack VM thereby rendering the application vulnerable to analysis and modification. We present a general description of the replacement attack methodology and two attack implementations against a protected application using freely available tools. The generality and simplicity of replacement attacks demonstrates that there is a strong need to develop techniques that meld applications more tightly to the protecting PVM to prevent such attacks.

Divilar

“…In this section, we first analyze DIVILAR's robustness against existing static and dynamic analysis, and countermeasures specific to VM-based protection in particular [11,20,57,59]. We also evaluate the performance overhead introduced by DIVILAR.…”

“…Ghosh et al propose to replace the protecting VM with an attacking VM in order to render the application amicable to analysis and modification [20]. Frequency analysis [68] is often used to break classical ciphers by studying the frequency of letters or groups of letters to disclose the mapping between plaintext and ciphertext.…”

“…However, this attack is not effective against systems where virtual machine is sufficiently anchored to the execution environment [20]. DIVILAR's in-app hooking mechanism allows it to deeply hook into Dalvik VM and merge the execution of virtual and Dalvik instructions.…”

“…Moreover, Ghosh et al propose to use an attacking VM to replace the protecting VM to subject the protected software to analysis. It assumes that the protecting VM is not tightly bound to the execution environment [20]. DIVILAR leverages virtualization to protect Android apps from repackaging.…”

Software protection for dynamically-generated code

“…An adversary can attempt to alter key functionalities of the PVM itself, thereby invalidating protection features such as knots. Ghosh et al proposed a replacement attack on PVMs, which involves replacing a PVM applying protections with a benign VM [16]. Knots do not protect the PVM from such attacks.…”