Translingual Obfuscation

Abstract

Abstract-Program obfuscation is an important software protection technique that prevents attackers from revealing the programming logic and design of the software. We introduce translingual obfuscation, a new software obfuscation scheme which makes programs obscure by "misusing" the unique features of certain programming languages. Translingual obfuscation translates part of a program from its original language to another language which has a different programming paradigm and execution model, thus increasing program complexity and impeding reverse engineering. In this paper, we investigate the feasibility and effectiveness of translingual obfuscation with Prolog, a logic programming language. We implement translingual obfuscation in a tool called BABEL, which can selectively translate C functions into Prolog predicates. By leveraging two important features of the Prolog language, i.e., unification and backtracking, BABEL obfuscates both the data layout and control flow of C programs, making them much more difficult to reverse engineer. Our experiments show that BABEL provides effective and stealthy software obfuscation, while the cost is only modest compared to one of the most popular commercial obfuscators on the market. With BABEL, we verified the feasibility of translingual obfuscation, which we consider to be a promising new direction for software obfuscation.

Field experience with obfuscating million‐user iOS apps in large enterprise mobile development

“…In contrast, evaluation through empirical experiments always raises concerns about the possibility that the obfuscation can be effectively nullified by some unknown or future deobfuscation methods not considered by the evaluation. Some recent effort has tried to establish standards for assessing the security strength of obfuscation techniques, but it remains unclear how well they can fit the demands of practical software protection.…”

“…Domas developed a compiler, which generates a binary employing only the mov family instructions, based on the fact that x86 mov is Turing complete. Wang et al, Lan et al, and Wang et al obfuscated C programs by translating them into declarative languages or abstract computation models, making imperative‐oriented analysis heuristics much less effective. There are also obfuscation methods that are less dependent on special software and hardware features but utilize more general techniques like compression, encryption, and virtualization .…”

Semantics-aware obfuscation scheme prediction for binary

“…These metrics have been proved to be able to evaluate the complexity of the obfuscated code and have been widely used to evaluate obfuscation techniques in related work. [55], [8], [13].…”

Layered obfuscation: a taxonomy of software obfuscation techniques for layered security

“…7, such techniques include code translation, VM(virtual machine)-based obfuscation, decompilation prevention, and diversification. Wang et al (2016) proposed translingual obfuscation, which introduces obscurity by translating the programs written in C into ProLog before compilation. Because ProLog adopts a different program paradigm and execution model from C, the generated binaries should become harder to understand.…”