QSynth - A Program Synthesis based approach for Binary Code Deobfuscation

Abstract

Assessing software robustness became arduous given the broad adoption of obfuscation in the industry and especially in mobile applications and embedded systems. As such, deobfuscation is becoming crucially important. Obfuscation usually concerns either target the control-flow or the data-flow of the program. While standard static and dynamic analyses suffer some shortcomings, Dynamic Symbolic Execution (DSE) turns out to be very effective on control-flow obfuscation. Yet, fewer approaches address issues raised by data-flow obfuscation. Program synthesis appears to be a promising approach to target such obfuscation. We present a generic approach leveraging both DSE and program synthesis to successfully synthesize programs obfuscated with Mixed-Boolean-Arithmetic, Data-Encoding or Virtualization. The synthesis algorithm proposed is an offline enumerate synthesis primitive guided by top-down breath-first search. We shows its effectiveness against a state-of-the-art obfuscator and its scalability as it supersedes other similar approaches based on synthesis. We also show its effectiveness in presence of composite obfuscation (combination of various techniques). This ongoing work enlightens the effectiveness of synthesis to target certain kinds of obfuscations and opens the way to more robust algorithms and simplification strategies.

Input-Output Example-Guided Data Deobfuscation on Binary

“…To the best of our knowledge, there are no predefined metrics to measure whether the deobfuscation result is easier to understand. David et al [23] provide a solution for evaluating the size reduction factor of the obfuscated expression against the synthesized one. In addition, we also use the user study in Section 6.6 to evaluate the deobfuscation results.…”

“…at is different from previous work since they all assume that the obfuscated instructions are known [22,23].…”

“…Program synthesis has been widely used in the following areas: automatic programming [28], peephole optimization [29,30], and generating the best code snippets [31,32]. Some works have proved the feasibility of program synthesis on deobfuscation [21][22][23]. Specifically, taking a given program as the specification of the equivalent program required in the target language, program synthesis can translate the given piece of code into a semantically equivalent code written in a certain target language.…”

“…erefore, deobfuscation in the way of compiler optimization may lead to the generated code being too simplified. e second category of deobfuscation is based on the program synthesis technique [20][21][22][23], which treats the target program as a black box. e underlying intuition is that a program's semantics can be understood as a mapping from input values to output values.…”

Generalizable synthesis through unification

“…In the second type, the oracle cannot verify the correctness of the synthesized program but can provide a set of input-output examples. This includes the applications where the oracle is a black-box program, such as binary programs [Zhai et al 2016], and applications where the program is too complex to verify its correctness, e.g., the task involves system calls or complex loops, such as program repair, second-order execution, and deobfuscation [Blazytko et al 2017;David et al 2020;Jha et al 2010;Mechtaev et al 2018Mechtaev et al , 2015a.…”