分支混淆中的条件异常代码构造研究

doi:10.11959/j.issn.2096-109x.2020061

Abstract

Abstract:

Using conditional exception code construction and exception handler to replace conditional jump code,the branch obfuscation get the right branch selection,but the address of branch point was concealed,so this obfuscation method can defeat symbolic execution by impeding the constraint condition collecting.The normal method of conditional exception code construction has a fault that the key data in conditional exception code has two-value problem,this fault make down the ability of branch obfuscation in impeding symbolic execution.Based on this shortcoming,a novel method which can make the key data in conditional exception code diversity was proposed.This method can improve the difficulty of constraint condition fetching,so the ability to defeat symbolic execution of branch obfuscation was enhanced.At last,a prototype obfuscation system based on structural exception handler was implemented to test the new method of conditional exception code construction.

Key words: conditional exception code construction, branch obfuscation, symbolic execution, structural exception handler

CLC Number:

TP311

Pu GENG,Yuefei ZHU. Research on construction of conditional exception code used in branch obfuscation[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 25-34.

Figures/Tables 7

References 18

[1]	VITICCHIé A , REGANO L , TORCHIANO M ,et al. Assessment of source code obfuscation techniques[C]// 2016 IEEE 16th International Working Conference on Source Code Analysis and Manipulation (SCAM). 2016: 11-20.
[2]	POPOV I V , DEBRAY S K , ANDREWS G R . Binary obfuscation using signals[C]// USENIX Security Symposium. 2007: 275-290.
[3]	SCHRITTWIESER S , KATZENBEISSER S , KIESEBERG P ,et al. Covert computation:hiding code in code for obfuscation purposes[C]// The 8th ACM SIGSAC Symposium on Information,Computer and Communications Security. 2013: 529-534.
[4]	AVIDAN E , FEITELSON D G . From obfuscation to comprehension[C]// 2015 IEEE 23rd International Conference on Program Comprehension. 2015: 178-181.
[5]	BALACHANDRAN V , KEONG N W , EMMANUEL S . Function level control flow obfuscation for software security[C]// 2014 Eighth International Conference on Complex,Intelligent and Software Intensive Systems (CISIS). 2014: 133-140.
[6]	BALACHANDRAN V , EMMANUEL S . Potent and stealthy control flow obfuscation by stack based self-modifying code[J]. IEEE Transactions on Information Forensics and Security, 2013,8(4): 669-681.
[7]	BALACHANDRAN V , EMMANUEL S . Software protection with obfuscation and encryption[C]// International Conference on Information Security Practice and Experience. 2013: 309-320.
[8]	BRUNI R , GIACOBAZZI R , GORI R . Code obfuscation against abstract model checking attacks[C]// International Conference on Verification,Model Checking,and Abstract Interpretation. 2018: 94-115.
[9]	CIMITILE A , MARTINELLI F , MERCALDO F ,et al. Formal methods meet mobile code obfuscation identification of code reordering technique[C]// 2017 IEEE 26th International Conference on Enabling Technologies:Infrastructure for Collaborative Enterprises(WETICE). 2017: 263-268.
[10]	BRUMLEY D , JAGER I , AVGERINOS T ,et al. BAP:a binary analysis platform[C]// International Conference on Computer Aided Verification. 2011: 463-469.
[11]	KING J C . Symbolic execution and program testing[J]. Communications of the ACM, 1976,19(7): 385-394.
[12]	BANESCU S , COLLBERG C , GANESH V ,et al. Code obfuscation against symbolic execution attacks[C]// The 32nd Annual Conference on Computer Security Applications. 2016: 189-200.
[13]	贾春福, 王志, 刘昕 ,等. 路径模糊:一种有效抵抗符号执行的二进制混淆技术[J]. 计算机研究与发展, 2011,48(11): 2111-2119.
	JIA C F , WANG Z , LIU X ,et al. Branch obfuscation：an efficient binary code obfuscation impede symbolic execution[J]. Journal of Computer Research and Development, 2011,48(11): 2111-2119.
[14]	王志, 贾春福, 刘伟杰 ,等. 一种抵抗符号执行的路径分支混淆技术[J]. 电子学报, 2015,43(5): 870-878.
	WANG Z , JIA C F , LIU W J ,et al. Branch obfuscation to combat symbolic execution[J]. Acta Electronica Sinica, 2015,43(5): 870-878.
[15]	BANESCU S , COLLBERG C , GANESH V ,et al. Code obfuscation against symbolic execution attacks[C]// The 32nd Annual Conference on Computer Security Applications. 2016: 189-200.
[16]	BANESCU S , COLLBERG C , PRETSCHNER A . Predicting the resilience of obfuscated code against symbolic execution attacks via machine learning[C]// The 26th USENIX Security Symposium. 2017.
[17]	LIN H , ZHANG X , YONG M ,et al. Branch obfuscation using binary code side effects[C]// International Conference on Computer,Networks and Communication Engineering (ICCNCE 2013). 2013.
[18]	陈喆, 贾春福, 宗楠 ,等. 随机森林在程序分支混淆中的应用[J]. 电子学报, 2018,46(10): 2458-2466.
	CHEN Z , JIA C F , ZONG N ,et al. Branch obfuscation using random Forest[J]. Acta Electronica Sinica, 2018,46(10): 2458-2466.

Metrics

Recommended 0

No Suggested Reading articles found!

条件异常代码构造方法	地址个数	地址与分支输入的关系	参与计算地址值的EFLAGS寄存器位数
改进前的方法	2个	分支输入参与地址计算；地址值随输入的变化而不同	1或2位
本文的改进方法	4 096个	分支输入不参与地址计算；仅当输入导致分支条件取值变化时，地址值改变	32位

混淆中的条件异常代码构造方法	被寄存器污染的内存访问地址数	轨迹中可反转的条件跳转指令数	按照可反转指令深度依次反转后的解
改进前的方法	3	3	192，168，128
本文改进后方法	0	0	无解

Research on construction of conditional exception code used in branch obfuscation

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 7

References 18

Related Articles 5

Metrics

Recommended 0

[1]	Yuqiang XIAO, Yunfei GUO, Yawen WANG. Metrics for code obfuscation based on symbolic execution and N-scope complexity [J]. Chinese Journal of Network and Information Security, 2022, 8(6): 123-134.
[2]	Xieli ZHANG, Yuefei ZHU, Chunxiang GU, Xi CHEN. Security protocol code analysis method combining model learning and symbolic execution [J]. Chinese Journal of Network and Information Security, 2021, 7(5): 93-104.
[3]	Pu GENG,Yuefei ZHU. Review of path branch obfuscation [J]. Chinese Journal of Network and Information Security, 2020, 6(2): 12-18.
[4]	Yan CAO, Long LIU, Yu WANG, Qingxian WANG. Software patch comparison technology through semantic analysis on function [J]. Chinese Journal of Network and Information Security, 2019, 5(5): 56-63.
[5]	Hui-ying YAN,Zhen-ji ZHOU,Li-fa WU,Zheng HONG,He SUN. Symbolic execution based control flow graph extraction method for Android native codes [J]. Chinese Journal of Network and Information Security, 2017, 3(7): 33-46.