分支混淆中的条件异常代码构造研究

耿普; 祝跃飞

doi:10.11959/j.issn.2096-109x.2020061

您当前的位置：

首页 >

文章列表页 >

分支混淆中的条件异常代码构造研究

专栏：网络应用与防护技术 | 更新时间：2024-06-03

- 分支混淆中的条件异常代码构造研究
- Research on construction of conditional exception code used in branch obfuscation
- 网络与信息安全学报 2020年6卷第6期页码：25-34
- 作者机构：
- 作者简介：
  
  [ "耿普（1982- ），男，云南宣威人，信息工程大学博士生，主要研究方向信息安全" ]
  [ "祝跃飞（1962- ），男，浙江杭州人，博士，信息工程大学教授、博士生导师，主要研究方向为网络空间安全" ]
- 基金信息：
  
  国家重点研发计划基金资助项目;The National Key R＆D Plan Program of China(2016YFB0801601);国家重点研发计划基金资助项目;The National Key R＆D Plan Program of China(2016YFB0801505)
- DOI：10.11959/j.issn.2096-109x.2020061
  中图分类号： TP311
- 网络首发：2020-12，
  
  纸质出版：2020-12-15
- 稿件说明：
移动端阅览
耿普, 祝跃飞. 分支混淆中的条件异常代码构造研究[J]. 网络与信息安全学报, 2020,6(6):25-34.

Pu GENG, Yuefei ZHU. Research on construction of conditional exception code used in branch obfuscation[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 25-34.
耿普, 祝跃飞. 分支混淆中的条件异常代码构造研究[J]. 网络与信息安全学报, 2020,6(6):25-34. DOI： 10.11959/j.issn.2096-109x.2020061.

Pu GENG, Yuefei ZHU. Research on construction of conditional exception code used in branch obfuscation[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 25-34. DOI： 10.11959/j.issn.2096-109x.2020061.

摘要

当前分支混淆技术通过构造条件异常代码和异常处理替代条件跳转指令，隐藏分支选择指令的地址，提高约束条件获取的难度，从而对抗符号执行。当前方法构造的条件异常代码中，关键数据具有二值性问题，有利于分支混淆的检测、发现和约束条件获取，降低了混淆的隐蔽性和与符号执行的对抗性；基于该缺点，提出一种使关键数据具有多样性特征的条件异常代码构造方法，增加了混淆的隐蔽性和约束条件的获取难度，提高分支混淆对抗符号执行的强度；通过结构化异常处理实现了基于新型条件异常代码构造的分支混淆原型系统，并对混淆进行了测试和分析。

Abstract

Using conditional exception code construction and exception handler to replace conditional jump code

the branch obfuscation get the right branch selection

but the address of branch point was concealed

so this obfuscation method can defeat symbolic execution by impeding the constraint condition collecting.The normal method of conditional exception code construction has a fault that the key data in conditional exception code has two-value problem

this fault make down the ability of branch obfuscation in impeding symbolic execution.Based on this shortcoming

a novel method which can make the key data in conditional exception code diversity was proposed.This method can improve the difficulty of constraint condition fetching

so the ability to defeat symbolic execution of branch obfuscation was enhanced.At last

a prototype obfuscation system based on structural exception handler was implemented to test the new method of conditional exception code construction.

关键词

Keywords

references

VITICCHIÉ A , REGANO L , TORCHIANO M , et al . Assessment of source code obfuscation techniques [C ] // 2016 IEEE 16th International Working Conference on Source Code Analysis and Manipulation (SCAM) . 2016 : 11 - 20 .

POPOV I V , DEBRAY S K , ANDREWS G R . Binary obfuscation using signals [C ] // USENIX Security Symposium . 2007 : 275 - 290 .

SCHRITTWIESER S , KATZENBEISSER S , KIESEBERG P , et al . Covert computation:hiding code in code for obfuscation purposes [C ] // The 8th ACM SIGSAC Symposium on Information,Computer and Communications Security . 2013 : 529 - 534 .

AVIDAN E , FEITELSON D G . From obfuscation to comprehension [C ] // 2015 IEEE 23rd International Conference on Program Comprehension . 2015 : 178 - 181 .

BALACHANDRAN V , KEONG N W , EMMANUEL S . Function level control flow obfuscation for software security [C ] // 2014 Eighth International Conference on Complex,Intelligent and Software Intensive Systems (CISIS) . 2014 : 133 - 140 .

BALACHANDRAN V , EMMANUEL S . Potent and stealthy control flow obfuscation by stack based self-modifying code [J ] . IEEE Transactions on Information Forensics and Security , 2013 , 8 ( 4 ): 669 - 681 .

BALACHANDRAN V , EMMANUEL S . Software protection with obfuscation and encryption [C ] // International Conference on Information Security Practice and Experience . 2013 : 309 - 320 .

BRUNI R , GIACOBAZZI R , GORI R . Code obfuscation against abstract model checking attacks [C ] // International Conference on Verification,Model Checking,and Abstract Interpretation . 2018 : 94 - 115 .

CIMITILE A , MARTINELLI F , MERCALDO F , et al . Formal methods meet mobile code obfuscation identification of code reordering technique [C ] // 2017 IEEE 26th International Conference on Enabling Technologies:Infrastructure for Collaborative Enterprises(WETICE) . 2017 : 263 - 268 .

BRUMLEY D , JAGER I , AVGERINOS T , et al . BAP:a binary analysis platform [C ] // International Conference on Computer Aided Verification . 2011 : 463 - 469 .

KING J C . Symbolic execution and program testing [J ] . Communications of the ACM , 1976 , 19 ( 7 ): 385 - 394 .

BANESCU S , COLLBERG C , GANESH V , et al . Code obfuscation against symbolic execution attacks [C ] // The 32nd Annual Conference on Computer Security Applications . 2016 : 189 - 200 .

贾春福 , 王志 , 刘昕 , 等 . 路径模糊:一种有效抵抗符号执行的二进制混淆技术 [J ] . 计算机研究与发展 , 2011 , 48 ( 11 ): 2111 - 2119 .

JIA C F , WANG Z , LIU X , et al . Branch obfuscation：an efficient binary code obfuscation impede symbolic execution [J ] . Journal of Computer Research and Development , 2011 , 48 ( 11 ): 2111 - 2119 .

王志 , 贾春福 , 刘伟杰 , 等 . 一种抵抗符号执行的路径分支混淆技术 [J ] . 电子学报 , 2015 , 43 ( 5 ): 870 - 878 .

WANG Z , JIA C F , LIU W J , et al . Branch obfuscation to combat symbolic execution [J ] . Acta Electronica Sinica , 2015 , 43 ( 5 ): 870 - 878 .

BANESCU S , COLLBERG C , GANESH V , et al . Code obfuscation against symbolic execution attacks [C ] // The 32nd Annual Conference on Computer Security Applications . 2016 : 189 - 200 .

BANESCU S , COLLBERG C , PRETSCHNER A . Predicting the resilience of obfuscated code against symbolic execution attacks via machine learning [C ] // The 26th USENIX Security Symposium . 2017 .

LIN H , ZHANG X , YONG M , et al . Branch obfuscation using binary code side effects [C ] // International Conference on Computer,Networks and Communication Engineering (ICCNCE 2013) . 2013 .

陈喆 , 贾春福 , 宗楠 , 等 . 随机森林在程序分支混淆中的应用 [J ] . 电子学报 , 2018 , 46 ( 10 ): 2458 - 2466 .

CHEN Z , JIA C F , ZONG N , et al . Branch obfuscation using random Forest [J ] . Acta Electronica Sinica , 2018 , 46 ( 10 ): 2458 - 2466 .

浏览量

342

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于符号执行和N-scope复杂度的代码混淆度量方法

模型学习与符号执行结合的安全协议代码分析技术

基于函数语义分析的软件补丁比对技术

基于符号执行的Android原生代码控制流图提取方法