Effectiveness of synthesis in concolic deobfuscation

Abstract

Control flow obfuscation techniques can be used to hinder software reverseengineering. Symbolic analysis can counteract these techniques, but only if they can analyze obfuscated conditional statements. We evaluate the use of dynamic synthesis to complement symbolic analysis in the analysis of obfuscated conditionals. We test this approach on the taint-analysis-resistant Mixed Boolean Arithmetics (MBA) obfuscation method that is commonly used to obfuscate and randomly diversify statements. We experimentally ascertain the practical feasibility of MBA obfuscation. We study using SMT-based approaches with different state-of-the-art SMT solvers to counteract MBA obfuscation, and we show how targeted algebraic simplification can greatly reduce the analysis time. We show that synthesis-based deobfuscation is more effective than current SMT-based deobfuscation algorithms, thus proposing a synthesis-based attacker model to complement existing attacker models.

SATURN - Software Deobfuscation Framework Based On LLVM

“…The work presented in [19], although based on binary execution traces, is a valid starting point to improve the detection of the dynamic opaque predicates in SATURN. While the work presented in [3] describes a strong simplification methodology based on the Drill&Join synthesis technique [1] which is orthogonal to the ones in SATURN and could further improve the MBA expressions handling. As discussed in Section 12, a plugin system would enable us to integrate these approaches during the exploration phase.…”

“…Effectiveness of Synthesis in Concolic Deobfuscation. Biondi et al summarize in [3] that SMT solvers alone are not efficient enough against MBA based obfuscation. As future work they proposed to study a tool that could drive the concolic execution of obfuscated programs by retrieving a compact representation of obfuscated constraints.…”

“…Instead, the path exploration is done based on the partially deobfuscated basic blocks and their predecessors. Our algorithm is similar to the Iterative Control Flow Graph Construction in [3] but is superior in the way that it works independently of the order in which the branches are examined.…”

Defeating Opaque Predicates Statically through Machine Learning and Binary Analysis

“…As a consequence, several works focus on the deobfuscation of opaque predicates (e.g. [5,7,8,16,29,32,42]) in order to evaluate the quality of the obfuscated code rendered by this transformation. However, these techniques are often based on dynamic analysis and are therefore limited or not scalable.…”

Binary Permutation Polynomial Inversion and Application to Obfuscation Techniques

“…Using a subfamily is a problem in the context of obfuscation since such polynomials will have an intrinsic form which can be recognized more easily and thus help the reverser. The attack proposed in [1] relies on this property.…”