Obfuscation of Executable Code to Improve Resistance to Static Disassembly
Cullen Linn, Saumya Debray
Department of Computer Science
University of Arizona
Tucson, AZ 85721, U.S.A.
Abstract
A great deal of software is distributed in the form of executable code.
The ability to reverse engineer such executables can create opportunities
for theft of intellectual property via software piracy, as well
as security breaches by allowing attackers to discover vulnerabilities
in an application.
The process of reverse engineering an executable program typically
begins with disassembly, which translates machine code to assembly code.
This is then followed by various decompilation steps that aim to recover
higher-level abstractions from the assembly code. Most of the work to
date on code obfuscation has focused on disrupting or confusing the
decompilation phase. This paper, by contrast, focuses on the initial
disassembly phase. Our goal is to disrupt the static
disassembly process so as to make programs harder to disassemble
correctly. We describe two widely used static disassembly algorithms,
and discuss techniques to thwart each of them. Experimental results
indicate that significant portions of executables that have been obfuscated
using our techniques are disassembled incorrectly, thereby showing
the efficacy of our methods.