Advancing Code Obfuscation: Novel Opaque Predicate Techniques to Counter Dynamic Symbolic Execution
Source abstract
Abstract
Code obfuscation is a crucial technique for protecting software against reverse engineering and security attacks. Among various obfuscation methods, opaque predicates, which are recognized as flexible and promising, are widely used to increase control-flow complexity. However, traditional opaque predicates are increasingly vulnerable to Dynamic Symbolic Execution (DSE) attacks, which can efficiently identify and eliminate them. To address this issue, this paper proposes a novel approach for anti-DSE opaque predicates that effectively resists symbolic execution-based deobfuscation. Our method introduces two key techniques: single-way function opaque predicates, which leverage hash functions and logarithmic transformations to prevent constraint solvers from generating feasible inputs, and path-explosion opaque predicates, which generate an excessive number of execution paths, overwhelming symbolic execution engines. To evaluate the effectiveness of our approach, we implemented a prototype obfuscation tool and tested it against prominent symbolic execution engines. Experimental results demonstrate that our approach significantly increases resilience against symbolic execution attacks while maintaining acceptable performance overhead. This paper provides a robust and scalable obfuscation technique, contributing to the enhancement of software protection strategies in adversarial environments.
Source: openalex_inverted_index · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
References (35)
Show source-provided references
1. Collberg · Addison-Wesley software security series · 2010 · 713
2. Collberg C, Thomborson C, Low D. A taxonomy of obfuscating transformations. Auckland, New Zealand: The University of Auckland; 1997. Technical Report No: 148.
3. Data hiding using code obfuscation
4. Sen · Proceedings of the 10th European Software Engineering Conference held jointly with 13th ACM SIGSOFT International Symposium on Foundations of Software Engineering · 2005 Sep 5–9; Lisbon, Portugal · 26310.1145/1081706.1081750 ↗
5. Symbolic execution for software testing: three decades later10.1145/2408776.2408795 ↗
6. All you ever wanted to know about dynamic taint analysis and forward symbolic execution (but might have been afraid to ask)
7. Protecting software through obfuscation: can it keep pace with progress in code analysis?
8. Obfuscator-LLVM: software protection for the masses
9. KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs
10. SOK: (State of) the art of war: offensive techniques in binary analysis
11. Symbolic execution and program testing10.1145/360248.360252 ↗
12. Backward-Bounded DSE: targeting infeasibility questions on obfuscated codes
13. SAGE: whitebox fuzzing for security testing10.1145/2093548.2093564 ↗
14. Specification of concretization and symbolization policies in symbolic execution
15. EXE: automatically generating inputs of death
16. DART: directed automated random testing
17. Concolic execution on small-size binaries: challenges and empirical study
18. Code obfuscation against symbolic execution attacks
19. A decision procedure for bit-vectors and arrays
20. Z3: an efficient smt solver
21. Deobfuscation of virtualization obfuscated software: a semantics-based approach
22. Symbolic deobfuscation: from virtualized code back to the original
23. A generic approach to automatic deobfuscation of executable code
24. Information hiding in software with mixed boolean-arithmetic transforms
25. Impeding malware analysis using conditional code obfuscation
26. Tigress. The tigress diversifying C Obfuscator [Internet]. [cited 2024 Jan 1]. Available from: https://tigress.wtf/.
27. How to kill symbolic deobfuscation for free (or: unleashing the potential of path-oriented protections)
28. Dinu D. ObfuscatorDynamic-LLVM: dynamic symbolic execution attack protections for the masses [dissertation]. Philadelphia, PA, USA: Drexel University; 2023.
29. Manufacturing resilient Bi-Opaque predicates against symbolic execution
30. Hirano · Advances in network-based information systems (NBiS 2022). Lecture notes in networks and systems · 2022 · 526
31. ROPfuscator: robust obfuscation with ROP
32. Bluesadi. DeBogus: automated Deobfuscation Tool [Internet]. [cited 2024 Jan 1]. Available from: https://github.com/bluesadi/debogus.
33. Software watermarking via opaque predicates: implementation, analysis, and attacks10.1007/s10660-006-6955-z ↗
34. Code obfuscation techniques for metamorphic viruses10.1007/s11416-008-0084-2 ↗
35. Google. CityHash: fast hash functions for strings [Internet]. [cited 2024 Jan 1]. Available from: https://github.com/google/cityhash.