Binary Obfuscation Using Signals Igor V Popov University

Binary Obfuscation Using Signals Igor V. Popov ( University of Arizona) Saumya K. Debray (University of Arizona) Gregory R. Andrews (University of Arizona) Presented by Ming Jiang

Introduction l l This paper addresses the problem of making it hard to reverse engineering binary programs by making it difficult to disassemble binary code statically. Binaries are obfuscated by changing many control transfers into signals (traps) and inserting bogus control transfers and “junk” instructions after the signals. Binary Obfuscation Using Signals 2

Two Assumptions By Disassemble 1. 2. l the address where each instruction begins can be determined; control transfer instructions can be identified and their targets determined. This paper shows how the second of these assumptions can be violated, such that actual control transfers in the program cannot be identified by a static disassembler. Binary Obfuscation Using Signals 3

Two Disassembly Algorithms l l Linear sweep: The linear sweep algorithm begins disassembly at the input program's first executable location, and simply sweeps through the entire text section disassembling each instruction as it is encountered. E. g. , GNU Utility – Objdump Recursive traversal: starts at the program's main entry point and proceeds by following each branch instruction encountered in a depthfirst or breadth-first manner. E. g. , IDA Pro Neither approach is 100% precise. Binary Obfuscation Using Signals 4

Overview Binary Obfuscation Using Signals 5

Key Aspects of the Approach 1. 2. A variety of different instructions and addresses can be used to raise a signal at runtime. mprotect() change protection The address used to generate the trap need not be a determinate value. Binary Obfuscation Using Signals 6

Key Aspects of the Approach 3. 4. A variety of different traps can be used. SIGFPE floating point exception SIGILL illegal instruction SIGSEGV illegal memory usage The location following the trap-generating instruction is unreachable, but this is not evident from standard control flow analyses. Binary Obfuscation Using Signals 7

Flip Conditional Branches JZ Address L: code after JNZ L JMP Address L: code after This transformation increasing the set of candidate locations where obfuscation can be applied. Binary Obfuscation Using Signals 8

Inserting Bogus Code l l confuse the control flow analysis of the program improve the stealthiness of the obfuscation Binary Obfuscation Using Signals 9

Signal Handing– Normal Case Binary Obfuscation Using Signals 10

Signal Handing– Obfuscated Case Binary Obfuscation Using Signals 11

Evaluation Metric Obfuscations are evaluated with respect to: l l Potency (disassembly errors) -To what degree is a human reader confused Resilience (control flow errors) -How well are automatic deobfuscation attacks resisted Cost-How much time/space overhead is added Stealth-How well does obfuscated code blend in with the original code. Whether the obfuscation process introduces any atypical instruction sequence signatures that could be used to identify the obfuscation code statically. Binary Obfuscation Using Signals 12

l l The IDA Pro, which is considered the best commercial disassembler, fails to disassemble 57% of the original instructions, over-reports control flow edges by 41%. However, obfuscation method slows down program execution because of signal processing overhead, the average slow-down is 21%. Binary Obfuscation Using Signals 13

Distribution of Individual Opcodes Binary Obfuscation Using Signals 14

Distribution of Opcode Pairs Binary Obfuscation Using Signals 15

Questions? Thank you 16