.png){kind=icon}
.png){kind=icon}
Return
Model of Execution Trace Obfuscation Between Threads
.png){kind=icon}
PRE
AI
DOI：10.1109/TDSC.2021.3123159.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Advanced reverse analysis tools have significantly improved the ability of attackers to crack software via dynamic analysis techniques, such as symbol execution and taint analysis. These techniques are widely used in malicious fields such as vulnerability exploitation or theft of intellectual property. In this paper, we present an obfuscation strategy called execution trace obfuscation, wherein the program execution trace repeatedly switches between multiple threads. Our technique realizes equivalent code transformation by abstracting the obfuscation problems into pruning, cloning, and coloring problems in graph theory. Based on this, we further propose the cascade encryption of a function that depends on execution trace information with a key derived from the function address calculation process, followed by removing this key from the program. We have implemented a compiler-level system that inputs a source program and automatically generates an obfuscated file. Finally, random test proves the universality of obfuscation algorithm and verify the system's performance. Results shows that our system can effectively interfere advanced reverse analysis tools.
Keywords:
Codes
Heuristic algorithms
Software algorithms
Message systems
Encryption
Software
Instruction sets
Anti-reverse
code transformation
graph theory
cascade encryption
multithreading
Journal
IF:
7.5
Papers:
2.4K
Citations:
9.6K