Binary Obfuscation Using Signals
Igor V. Popov ( University of Arizona)
Saumya K. Debray (University of Arizona)
Gregory R. Andrews (University of Arizona)
Presented by Ming Jiang
Introduction
This paper addresses the problem of making it hard to reverse engineering binary programs by making it difficult to disassemble binary code statically.
Binaries are obfuscated by changing many control transfers into signals (traps) and inserting bogus control transfers and “junk” instructions after the signals.
Binary Obfuscation Using Signals2
Two Assumptions By Disassemble
1. the address where each instruction begins can be determined;
2. control transfer instructions can be identified and their targets determined.
This paper shows how the second of these assumptions can be violated, such that actual control transfers in the program cannot be identified by a static disassembler.
Binary Obfuscation Using Signals3
Two Disassembly Algorithms
Linear sweep: The linear sweep algorithm begins disassembly at the input program's first executable location, and simply sweeps through the entire text section disassembling each instruction as it is encountered.
E.g., GNU Utility – Objdump Recursive traversal: starts at the program's
main entry point and proceeds by following each branch instruction encountered in a depth-first or breadth-first manner. E.g., IDA Pro
Neither approach is 100% precise. Binary Obfuscation Using Signals
4
Overview
Binary Obfuscation Using Signals5
Key Aspects of the Approach
1. A variety of different instructions and addresses can be used to raise a signal at runtime. mprotect() change protection
2. The address used to generate the trap need not be a determinate value.
Binary Obfuscation Using Signals6
Key Aspects of the Approach
3. A variety of different traps can be used.
SIGFPE floating point exception
SIGILL illegal instruction
SIGSEGV illegal memory usage
4. The location following the trap-generating instruction is unreachable, but this is not evident from standard control flow analyses.
Binary Obfuscation Using Signals7
Flip Conditional Branches
Binary Obfuscation Using Signals8
This transformation increasing the set of candidate locations where obfuscation can be applied.
Inserting Bogus Code
confuse the control flow analysis of the program improve the stealthiness of the obfuscation
Binary Obfuscation Using Signals9
Signal Handing– Normal Case
Binary Obfuscation Using Signals10
Signal Handing– Obfuscated Case
Binary Obfuscation Using Signals11
Evaluation Metric
Obfuscations are evaluated with respect to: Potency (disassembly errors) -To what degree is a
human reader confused Resilience (control flow errors) -How well are
automatic deobfuscation attacks resisted Cost-How much time/space overhead is added Stealth-How well does obfuscated code blend in
with the original code. Whether the obfuscation process introduces any atypical instruction sequence signatures that could be used to identify the obfuscation code statically.
Binary Obfuscation Using Signals12
The IDA Pro, which is considered the best commercial disassembler, fails to disassemble 57% of the original instructions, over-reports control flow edges by 41%.
However, obfuscation method slows down program execution because of signal processing overhead, the average slow-down is 21%.
Binary Obfuscation Using Signals13
Distribution of Individual Opcodes
Binary Obfuscation Using Signals14
Distribution of Opcode Pairs
Binary Obfuscation Using Signals15
16
Questions?
Thank you