Binary Obfuscation Using Signals
Igor Popov,
Saumya Debray,
Gregory Andrews
Department of Computer Science
University of Arizona
Tucson, AZ 85721, U.S.A.
Abstract
Reverse engineering of software is the process of recovering
higher-level structure and meaning from a lower-level program representation.
It can be used for legitimate purposes---e.g., to recover
source code that has been lost---but it is often used for
nefarious purposes, e.g., to search for security vulnerabilities in
binaries or to steal intellectual property.
This paper addresses the problem of making it hard to
reverse engineering binary programs
by making it difficult to disassemble machine code statically.
Binaries are obfuscated by changing many control
transfers into signals (traps)
and inserting dummy control transfers and "junk" instructions after
the signals.
The resulting code is still a correct program, but even the best current
disassemblers are unable to disassemble 40%-60% of the
instructions in the program.
Furthermore, the disassemblers have a mistaken understanding of
over half of the control flow edges.
However, the obfuscated program necessarily executes
more slowly than the original.
Experimental results quantify the degree of obfuscation,
stealth of the code, and effects on execution time and code size.