Backward-Bounded DSE: Targeting Infeasibility Questions on Obfuscated Codes

Bardin, Sébastien; David, Robin; Marion, Jean-Yves

doi:10.1109/sp.2017.36

Cited by 38 publications

(45 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, current state-of-the-art deobfuscation approaches use automated proving to compute if a predicate is opaque [5,29].…”

Section: Deobfuscationmentioning

confidence: 99%

“…This is the reason why recent automated proving techniques are based on dynamic symbolic execution (i.e. DSE) to check path feasibility or infeasibility [5] and remove opaque predicates. Yet, automated proving based analysis, either static or dynamic, suffers from the SMT solvers restrictions.…”

Section: Deobfuscationmentioning

confidence: 99%

“…As a consequence, several works focus on the deobfuscation of opaque predicates (e.g. [5,7,8,16,29,32,42]) in order to evaluate the quality of the obfuscated code rendered by this transformation. However, these techniques are often based on dynamic analysis and are therefore limited or not scalable.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

Tofighi-Shirazi

Asavoae

Elbaz-Vincent

et al. 2019

Proceedings of the 3rd ACM Workshop on Software Protection

View full text Add to dashboard Cite

We present a new approach that bridges binary analysis techniques with machine learning classification for the purpose of providing a static and generic evaluation technique for opaque predicates, regardless of their constructions. We use this technique as a static automated deobfuscation tool to remove the opaque predicates introduced by obfuscation mechanisms. According to our experimental results, our models have up to 98% accuracy at detecting and deobfuscating state-of-the-art opaque predicates patterns. By contrast, the leading edge deobfuscation methods based on symbolic execution show less accuracy mostly due to the SMT solvers constraints and the lack of scalability of dynamic symbolic analyses. Our approach underlines the efficiency of hybrid symbolic analysis and machine learning techniques for a static and generic deobfuscation methodology.

show abstract

“…Moreover, current state-of-the-art deobfuscation approaches use automated proving to compute if a predicate is opaque [5,29].…”

Section: Deobfuscationmentioning

confidence: 99%

Section: Deobfuscationmentioning

confidence: 99%

See 1 more Smart Citation

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

Tofighi-Shirazi

Asavoae

Elbaz-Vincent

et al. 2019

Proceedings of the 3rd ACM Workshop on Software Protection

View full text Add to dashboard Cite

show abstract

“…concolic execution) [17,28,38] use logical formulas to represent input constraints along an execution path, and then automatically solve these constraints to discover new execution paths. DSE appears to be very efficient against existing obfuscations [5,8,22,35,49], combining the best of dynamic and semantic analysis.…”

Section: Introductionmentioning

confidence: 99%

How to kill symbolic deobfuscation for free (or: unleashing the potential of path-oriented protections)

Ollivier

Bardin

Bonichon

et al. 2019

Proceedings of the 35th Annual Computer Security Applications Conference

Self Cite

View full text Add to dashboard Cite

Code obfuscation is a major tool for protecting software intellectual property from attacks such as reverse engineering or code tampering. Yet, recently proposed (automated) attacks based on Dynamic Symbolic Execution (DSE) shows very promising results, hence threatening software integrity. Current defenses are not fully satisfactory, being either not efficient against symbolic reasoning, or affecting runtime performance too much, or being too easy to spot. We present and study a new class of anti-DSE protections coined as path-oriented protections targeting the weakest spot of DSE, namely path exploration. We propose a lightweight, efficient, resistant and analytically proved class of obfuscation algorithms designed to hinder DSE-based attacks. Extensive evaluation demonstrates that these approaches critically counter symbolic deobfuscation while yielding only a very slight overhead.

show abstract

“…State-of-the-art deobfuscation techniques are o en speci c to obfuscation transformations. For example, the work of Udupa et al [64] targets control-ow transformations, whereas others [6,42,47,62] aim at removing opaque predicates. Generic deobfuscation techniques, however, make no assumption about the applied protections [54,71].…”

Section: Introductionmentioning

confidence: 99%

Fine-grained static detection of obfuscation transforms using ensemble-learning and semantic reasoning

Tofighi-Shirazi

Asavoae

Elbaz-Vincent

2019

Proceedings of the 9th Workshop on Software Security, Protection, and Reverse Engineering

View full text Add to dashboard Cite

e ability to e ciently detect the so ware protections used is at a prime to facilitate the selection and application of adequate deobfuscation techniques. We present a novel approach that combines semantic reasoning techniques with ensemble learning classi cation for the purpose of providing a static detection framework for obfuscation transformations. By contrast to existing work, we provide a methodology that can detect multiple layers of obfuscation, without depending on knowledge of the underlying functionality of the training-set used. We also extend our work to detect constructions of obfuscation transformations, thus providing a ne-grained methodology. To that end, we provide several studies for the best practices of the use of machine learning techniques for a scalable and e cient model. According to our experimental results and evaluations on obfuscators such as Tigress and OLLVM, our models have up to 91% accuracy on state-of-the-art obfuscation transformations. Our overall accuracies for their constructions are up to 100%.

show abstract

Backward-Bounded DSE: Targeting Infeasibility Questions on Obfuscated Codes

Cited by 38 publications

References 38 publications

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

How to kill symbolic deobfuscation for free (or: unleashing the potential of path-oriented protections)

Fine-grained static detection of obfuscation transforms using ensemble-learning and semantic reasoning

Contact Info

Product

Resources

About