Obfuscation of executable code to improve resistance to static disassembly

Subscribe (Full Service)


	Search: The ACM Digital Library The Guide

	Feedback

Obfuscation of executable code to improve resistance to static disassembly

Full text

Pdf (156 KB)

Source

Conference on Computer and Communications Security archive
Proceedings of the 10th ACM conference on Computer and communications security table of contents

Washington D.C., USA

SESSION: Emerging applications table of contents

Pages: 290 - 299

Year of Publication: 2003

ISBN:1-58113-738-9

Authors

Cullen Linn	University of Arizona, Tucson, AZ
Saumya Debray	University of Arizona, Tucson, AZ

Sponsor

ACM: Association for Computing Machinery

Publisher

ACM New York, NY, USA

Bibliometrics

Downloads (6 Weeks): 31, Downloads (12 Months): 170, Citation Count: 31

Additional Information:

abstract references cited by index terms collaborative colleagues

Tools and Actions:	Request Permissions Review this Article Save this Article to a Binder Display Formats: BibTeX EndNote ACM Ref

DOI Bookmark:	Use this link to bookmark this Article: http://doi.acm.org/10.1145/948109.948149 What is a DOI?

ABSTRACT

A great deal of software is distributed in the form of executable code. The ability to reverse engineer such executables can create opportunities for theft of intellectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabilities in an application. The process of reverse engineering an executable program typically begins with disassembly, which translates machine code to assembly code. This is then followed by various decompilation steps that aim to recover higher-level abstractions from the assembly code. Most of the work to date on code obfuscation has focused on disrupting or confusing the decompilation phase. This paper, by contrast, focuses on the initial disassembly phase. Our goal is to disrupt the static disassembly process so as to make programs harder to disassemble correctly. We describe two widely used static disassembly algorithms, and discuss techniques to thwart each of them. Experimental results indicate that significant portions of executables that have been obfuscated using our techniques are disassembled incorrectly, thereby showing the efficacy of our methods.

REFERENCES

Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references.

	1	David Aucsmith, Tamper Resistant Software: An Implementation, Proceedings of the First International Workshop on Information Hiding, p.317-333, May 30-June 01, 1996
	2	Robert L. Bernstein, Producing good code for the case statement, Software—Practice & Experience, v.15 n.10, p.1021-1024, Oct. 1985 [doi>10.1002/spe.4380151009]
	3	W. Cho, I. Lee, and S. Park. Againt intelligent tampering: Software tamper resistance by extended control flow obfuscation. In Proc. World Multiconference on Systems, Cybernetics, and Informatics. International Institute of Informatics and Systematics, 2001.
	4	Cristina Cifuentes , K. John Gough, Decompilation of binary programs, Software—Practice & Experience, v.25 n.7, p.811-829, July 1995 [doi>10.1002/spe.4380250706]
	5	Cristina Cifuentes , Mike Van Emmerik, UQBT: Adaptable Binary Translation at Low Cost, Computer, v.33 n.3, p.60-66, March 2000 [doi>10.1109/2.825697]
	6	Cristina Cifuentes , Mike Van Emmerik, Recovery of jump table case statements from binary code, Science of Computer Programming, v.40 n.2-3, p.171-188, July 2001 [doi>10.1016/S0167-6423(01)00014-4]
	7	F. B. Cohen. Operating system protection through program evolution, 1992. http://all.net/books/IP/evolve.html.
	8	Robert S. Cohn , David W. Goodwin , P. Geoffrey Lowney, Optimizing alpha executables on Windows NT with spike, Digital Technical Journal, v.9 n.4, p.3-20, April 1998
	9	Christian Collberg , Clark Thomborson, Software watermarking: models and dynamic embeddings, Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.311-324, January 20-22, 1999, San Antonio, Texas, United States [doi>10.1145/292540.292569]
	10	C. Collberg and C. Thomborson. Watermarking, tamper-proofing, and obfuscation -- tools for software protecti on. Technical Report TR00-03, The Department of Computer Science, University of Arizona, February 2000.
	11	Christian Collberg , Clark Thomborson , Douglas Low, Breaking Abstractions and Unstructuring Data Structures, Proceedings of the 1998 International Conference on Computer Languages, p.28, May 14-16, 1998
	12	Christian Collberg , Clark Thomborson , Douglas Low, Manufacturing cheap, resilient, and stealthy opaque constructs, Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, p.184-196, January 19-21, 1998, San Diego, California, United States [doi>10.1145/268946.268962]
	13	DataRescue sa/nv, Liege, Belgium. IDA Pro. http://www.datarescue.com/idabase/.
	14	Michael L. Fredman , János Komlós , Endre Szemerédi, Storing a Sparse Table with 0(1) Worst Case Access Time, Journal of the ACM (JACM), v.31 n.3, p.538-544, July 1984 [doi>10.1145/828.1884]
	15	John R. Levine, Linkers and Loaders, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1999
	16	David Lie Chandramohan Thekkath , Mark Mitchell , Patrick Lincoln , Dan Boneh , John Mitchell , Mark Horowitz, Architectural support for copy and tamper resistant software, Proceedings of the ninth international conference on Architectural support for programming languages and operating systems, p.168-177, November 2000, Cambridge, Massachusetts, United States
	17	K. Mehlhorn , A. Tsakalidis, Data structures, Handbook of theoretical computer science (vol. A): algorithms and complexity, MIT Press, Cambridge, MA, 1991
	18	Robert Muth , Saumya K. Debray , Scott Watterson , Koen De Bosschere, Alto: a link-time optimizer for the Compaq alpha, Software—Practice & Experience, v.31 n.1, p.67-101, Jan. 2001 [doi>10.1002/1097-024X(200101)31:1<67::AID-SPE357>3.0.CO;2-A]
	19	Objdump. GNU Manuals Online. GNU Project---Free Software Foundation. http://www.gnu.org/manual/binutils-2.10.1/html_chapter/binutils_4.html.
	20	T. Ogiso, Y. Sakabe, M. Soshi, and A. Miyaji. Software obfuscation on a theoretical basis and its implementation. IEEE Trans. Fundamentals, E86-A(1), January 2003.
	21	B. Schwarz, S. K. Debray, and G. R. Andrews. Plto: A link-time optimizer for the Intel IA-32 architecture. In Proc. 2001 Workshop on Binary Translation (WBT-2001), 2001.
	22	B. Schwarz , S. Debray , G. Andrews, Disassembly of Executable Code Revisited, Proceedings of the Ninth Working Conference on Reverse Engineering (WCRE'02), p.45, October 29-November 01, 2002
	23	Richard L. Sites , Anton Chernoff , Matthew B. Kirk , Maurice P. Marks , Scott G. Robinson, Binary translation, Communications of the ACM, v.36 n.2, p.69-81, Feb. 1993 [doi>10.1145/151220.151227]
	24	A. Srivastava and D. W. Wall. A practical system for intermodule code optimization at link-time. Journal of Programming Languages, 1(1):1--18, March 1993.
	25	H. Theiling, Extracting safe and precise control flow from binaries, Proceedings of the Seventh International Conference on Real-Time Systems and Applications (RTCSA'00), p.23, December 12-14, 2000
	26	Chenxi Wang , Jonathan Hill , John C. Knight , Jack W. Davidson, Protection of Software-Based Survivability Mechanisms, Proceedings of the 2001 International Conference on Dependable Systems and Networks (formerly: FTCS), p.193-202, July 01-04, 2001
	27	Chenxi Wang , Jonathan Hill , John Knight , Jack Davidson, Software Tamper Resistance: Obstructing Static Analysis of Programs, University of Virginia, Charlottesville, VA, 2000
	28	G. Wroblewski. General Method of Program Code Obfuscation. PhD thesis, Wroclaw University of Technology, Institute of Engineering Cybernetics, 2002.

CITED BY 31

	C. Collberg , E. Carter , S. Debray , A. Huntwork , J. Kececioglu , C. Linn , M. Stepp, Dynamic path-based software watermarking, ACM SIGPLAN Notices, v.39 n.6, May 2004
	James E. Just , Mark Cornwell, Review and analysis of synthetic diversity for breaking monocultures, Proceedings of the 2004 ACM workshop on Rapid malcode, October 29-29, 2004, Washington DC, USA
	Matias Madou , Bertrand Anckaert , Bjorn De Sutter , Koen De Bosschere, Hybrid static-dynamic attacks against software protection mechanisms, Proceedings of the 5th ACM workshop on Digital rights management, November 07-07, 2005, Alexandria, VA, USA
	John Regehr , Alastair Reid, HOIST: a system for automatically deriving static analyzers for embedded systems, ACM SIGOPS Operating Systems Review, v.38 n.5, December 2004
	Matias Madou , Ludo Van Put , Koen De Bosschere, LOCO: an interactive code (De)obfuscation tool, Proceedings of the 2006 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation, January 09-10, 2006, Charleston, South Carolina
	G. Myles , S. Nusser, Content protection for games, IBM Systems Journal, v.45 n.1, p.119-143, January 2006
	Igor V. Popov , Saumya K. Debray , Gregory R. Andrews, Binary obfuscation using signals, Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium, p.1-16, August 06-10, 2007, Boston, MA
	Manuel Egele , Christopher Kruegel , Engin Kirda , Heng Yin , Dawn Song, Dynamic spyware analysis, 2007 USENIX Annual Technical Conference on Proceedings of the USENIX Annual Technical Conference, p.1-14, June 17-22, 2007, Santa Clara, CA
	Mila Dalla Preda , Mihai Christodorescu , Somesh Jha , Saumya Debray, A semantics-based approach to malware detection, ACM SIGPLAN Notices, v.42 n.1, January 2007
	Abdulrahman Alarifi , Wenliang Du, Diversify sensor nodes to improve resilience against node compromise, Proceedings of the fourth ACM workshop on Security of ad hoc and sensor networks, October 30-30, 2006, Alexandria, Virginia, USA
	Bertrand Anckaert , Mariusz Jakubowski , Ramarathnam Venkatesan, Proteus: virtualization for diversified tamper-resistance, Proceedings of the ACM workshop on Digital rights management, October 30-30, 2006, Alexandria, Virginia, USA
	Laune C. Harris , Barton P. Miller, Practical analysis of stripped binary code, ACM SIGARCH Computer Architecture News, v.33 n.5, December 2005
	Christopher Kruegel , William Robertson , Fredrik Valeur , Giovanni Vigna, Static disassembly of obfuscated binaries, Proceedings of the 13th conference on USENIX Security Symposium, p.18-18, August 09-13, 2004, San Diego, CA
	C. M. Linn , M. Rajagopalan , S. Baker , C. Collberg , S. K. Debray , J. H. Hartman, Protecting against unexpected system calls, Proceedings of the 14th conference on USENIX Security Symposium, p.16-16, July 31-August 05, 2005, Baltimore, MD
	Hongxia Jin , Ginger Myles , Jeffrey Lotspiech, Key evolution-based tamper resistance: a subgroup extension, Proceedings of the 2nd ACM symposium on Information, computer and communications security, March 20-22, 2007, Singapore
	Matthias Jacob , Mariusz H. Jakubowski , Ramarathnam Venkatesan, Towards integral binary execution: implementing oblivious hashing using overlapped instruction encodings, Proceedings of the 9th workshop on Multimedia & security, September 20-21, 2007, Dallas, Texas, USA
	Susanta Nanda , Wei Li , Lap-Chung Lam , Tzi-cker Chiueh, BIRD: Binary Interpretation using Runtime Disassembly, Proceedings of the International Symposium on Code Generation and Optimization, p.358-370, March 26-29, 2006
	Arun Lakhotia , Eric Uday Kumar , Michael Venable, A Method for Detecting Obfuscated Calls in Malicious Binaries, IEEE Transactions on Software Engineering, v.31 n.11, p.955-968, November 2005
	Danny Nebenzahl , Mooly Sagiv , Avishai Wool, Install-Time Vaccination of Windows Executables to Defend against Stack Smashing Attacks, IEEE Transactions on Dependable and Secure Computing, v.3 n.1, p.78, January 2006
	Bertrand Anckaert , Matias Madou , Bjorn De Sutter , Bruno De Bus , Koen De Bosschere , Bart Preneel, Program obfuscation: a quantitative approach, Proceedings of the 2007 ACM workshop on Quality of protection, October 29-29, 2007, Alexandria, Virginia, USA
	Min Gyung Kang , Pongsin Poosankam , Heng Yin, Renovo: a hidden code extractor for packed executables, Proceedings of the 2007 ACM workshop on Recurring malcode, November 02-02, 2007, Alexandria, Virginia, USA
	Jisoo Yang , Kang G. Shin, Using hypervisor to provide data secrecy for user applications on a per-page basis, Proceedings of the fourth ACM SIGPLAN/SIGOPS international conference on Virtual execution environments, March 05-07, 2008, Seattle, WA, USA
	Qijun Gu , Rizwan Noorani, Towards self-propagate mal-packets in sensor networks, Proceedings of the first ACM conference on Wireless network security, March 31-April 02, 2008, Alexandria, VA, USA
	Prashant Dewan , David Durham , Hormuzd Khosravi , Men Long , Gayathri Nagabhushan, A hypervisor-based system for protecting software runtime memory and persistent storage, Proceedings of the 2008 Spring simulation multiconference, April 14-17, 2008, Ottawa, Canada
	Alex Moshchuk , Steven D. Gribble , Henry M. Levy, Flashproxy: transparently enabling rich web content via remote execution, Proceeding of the 6th international conference on Mobile systems, applications, and services, June 17-20, 2008, Breckenridge, CO, USA
	Mila Dalla Preda , Mihai Christodorescu , Somesh Jha , Saumya Debray, A semantics-based approach to malware detection, ACM Transactions on Programming Languages and Systems (TOPLAS), v.30 n.5, p.1-54, August 2008
	Christopher Ferguson , Qijun Gu , Hongchi Shi, Self-healing control flow protection in sensor applications, Proceedings of the second ACM conference on Wireless network security, March 16-19, 2009, Zurich, Switzerland
	Seokwoo Choi , Heewan Park , Hyun-il Lim , Taisook Han, A static API birthmark for Windows binary executables, Journal of Systems and Software, v.82 n.5, p.862-873, May, 2009
	Mahadevan Gomathisankaran , Akhilesh Tyagi, Architecture Support for 3D Obfuscation, IEEE Transactions on Computers, v.55 n.5, p.497-507, May 2006
	Sanjay Rawat , Ashutosh Saxena, Application security code analysis: a step towards software assurance, International Journal of Information and Computer Security, v.3 n.1, p.86-110, June 2009
	Nathan Rosenblum , Xiaojin Zhu , Barton Miller , Karen Hunt, Learning to analyze binary computer code, Proceedings of the 23rd national conference on Artificial intelligence, p.798-804, July 13-17, 2008, Chicago, Illinois