obfuscating transformations - yury lifshitsﬂow and basic blocks) makes some appropriateness...

ObfuscatingTransforma-

tions

Yury Lifshits

What isObfuscator?Notion ofObfuscator

Anatomy ofObfuscator

ObfuscatorCharacteristics

ObfuscationLibraryProgramRepresentation

Data & Control :Basic Tricks

Control FlowObfuscation

Even moretransformations

Obfuscationvs. Deobfus-cationClassical ProgramAnalysis

DeobfuscationHardness

Further Research

Summary

Obfuscating Transformations

Yury Lifshits

Mathematics & Mechanics FacultySaint Petersburg State University

Spring 2005 – SETLab


tions

Yury Lifshits










Further Research

Summary

Outline

1 What is Obfuscator?Notion of ObfuscatorAnatomy of ObfuscatorObfuscator Characteristics


tions

Yury Lifshits










Further Research

Summary

Outline


2 Library of Obfuscating TransformationsProgram RepresentationData & Control : Basic TricksControl Flow ObfuscationEven more transformations


tions

Yury Lifshits










Further Research

Summary

Outline


2 Library of Obfuscating TransformationsProgram RepresentationData & Control : Basic TricksControl Flow ObfuscationEven more transformations

3 Obfuscation vs. DeobfuscationClassical Program AnalysisDeobfuscation HardnessFurther Research


tions

Yury Lifshits










Further Research

Summary

Motivation: Java Virtual Machine

What is difference between Java and others?


tions

Yury Lifshits










Further Research

Summary



Most programming languages:

Source Code↓

Machine Code↓

PredefinedArchitecture


tions

Yury Lifshits










Further Research

Summary




Source Code↓

Machine Code↓


Java:

Java Source Code↓

Java-byte Code↓

Virtual Processor = JVM

OS & Hardware


tions

Yury Lifshits










Further Research

Summary




Source Code↓

Machine Code↓


Java:

Java Source Code↓

Java-byte Code↓

Virtual Processor = JVM

OS & Hardware

Java Virtual Machine: implemented on huge number of hardwarearchitectures / operating systems


tions

Yury Lifshits










Further Research

Summary

Notion of Obfuscator

Objectives:

➯ Make code not readable by human


tions

Yury Lifshits










Further Research

Summary


Objectives:


➯ Make automated analysis difficult


tions

Yury Lifshits










Further Research

Summary


Objectives:



➯ Make code more complicated


tions

Yury Lifshits










Further Research

Summary


Objectives:



➯ Make code more complicated

➯ Make decompilation & reverse engineering difficult


tions

Yury Lifshits










Further Research

Summary

Anatomy of Obfuscator I

How real obfuscator works?


tions

Yury Lifshits










Further Research

Summary



1 Prepares program to be obfuscated


tions

Yury Lifshits










Further Research

Summary




2 Makes a single transformation


tions

Yury Lifshits










Further Research

Summary




2 Makes a single transformation

3 Repeats step 2 until task completed or constraintsexceeded


tions

Yury Lifshits










Further Research

Summary

Anatomy of Obfuscator II

How real obfuscator works (more precisely)?


tions

Yury Lifshits










Further Research

Summary



The workflow is:

➯ Parse input program


tions

Yury Lifshits










Further Research

Summary



The workflow is:


Makes a list of obfuscation candidates: classes, variables,methods


tions

Yury Lifshits










Further Research

Summary



The workflow is:


Makes a list of obfuscation candidates: classes, variables,methodsConstructs internal representation of the program (e.g. controlflow and basic blocks)


tions

Yury Lifshits










Further Research

Summary



The workflow is:


Makes a list of obfuscation candidates: classes, variables,methodsConstructs internal representation of the program (e.g. controlflow and basic blocks)Makes some appropriateness suggestions


tions

Yury Lifshits










Further Research

Summary



The workflow is:



➯ Main while loop (until constraints are exceeded or quality isachieved)


tions

Yury Lifshits










Further Research

Summary



The workflow is:




Choose next (by priority) element of the program to beobfuscated


tions

Yury Lifshits










Further Research

Summary



The workflow is:




Choose next (by priority) element of the program to beobfuscatedImplement appropriate obfuscating transformation (fromobfuscator library)


tions

Yury Lifshits










Further Research

Summary



The workflow is:




Choose next (by priority) element of the program to beobfuscatedImplement appropriate obfuscating transformation (fromobfuscator library)Update internal representation


tions

Yury Lifshits










Further Research

Summary

Quality of Obfuscation

Slide from Lecture 1


tions

Yury Lifshits










Further Research

Summary



So you supposed to explain it to me...


tions

Yury Lifshits










Further Research

Summary



So you supposed to explain it to me...

Strength can be measured by:

➯ PotencyE(P′)E(P)

− 1

➯ ResilienceTrivial, weak, strong, full, one-way

➯ CostFree, cheap, costly, expensive

➯ Stealthy


tions

Yury Lifshits










Further Research

Summary

Program Complexity Metrics

We want: make program complicated


tions

Yury Lifshits










Further Research

Summary



So what is program code complexity?


tions

Yury Lifshits










Further Research

Summary




➯ Program length


tions

Yury Lifshits










Further Research

Summary




➯ Program lengthNumber of operators and operands


tions

Yury Lifshits










Further Research

Summary





➯ Data flow complexity


tions

Yury Lifshits










Further Research

Summary





➯ Data flow complexityNumber of inter-block variable references


tions

Yury Lifshits










Further Research

Summary






➯ Cyclomatic complexity


tions

Yury Lifshits










Further Research

Summary






➯ Cyclomatic complexityNumber of predicates in a function


tions

Yury Lifshits










Further Research

Summary







➯ Nesting complexity


tions

Yury Lifshits










Further Research

Summary







➯ Nesting complexityNumber of nesting level of conditionals in a program


tions

Yury Lifshits










Further Research

Summary








➯ Data structure complexity


tions

Yury Lifshits










Further Research

Summary








➯ Data structure complexityComplexity of the static data structures in the program like

variables, vectors, records


tions

Yury Lifshits










Further Research

Summary










➯ OO Metrics


tions

Yury Lifshits










Further Research

Summary










➯ OO MetricsLevel of inheritance, coupling, number of methods triggered by

another method, non-cohesiveness


tions

Yury Lifshits










Further Research

Summary

Cost Analysis

What do we pay for security?


tions

Yury Lifshits










Further Research

Summary

Cost Analysis


➯ Costs at creation timeObfuscation need time!


tions

Yury Lifshits










Further Research

Summary

Cost Analysis



➯ Costs at transmition time (resulting size)Inlining library functions may increase size enormously!


tions

Yury Lifshits










Further Research

Summary

Cost Analysis




➯ Cost at execution timeChecking procedures, dummy code, inlining


tions

Yury Lifshits










Further Research

Summary

Cost Analysis




➯ Cost at execution timeChecking procedures, dummy code, inlining

➯ Cost by not using efficiency enhancing mechanismsCaching is rarely possible; losing module structure


tions

Yury Lifshits










Further Research

Summary

Statistics measurement

Other metrics?


tions

Yury Lifshits










Further Research

Summary


Other metrics?

Statistics! What kind of?


tions

Yury Lifshits










Further Research

Summary


Other metrics?


➯ Distribution of basic construstions


tions

Yury Lifshits










Further Research

Summary


Other metrics?


➯ Distribution of basic construstionsUse rare elements more often


tions

Yury Lifshits










Further Research

Summary


Other metrics?



➯ Clustering of program elements. Uniform distribution –difficult to understand!


tions

Yury Lifshits










Further Research

Summary


Other metrics?




Usage of variables


tions

Yury Lifshits










Further Research

Summary


Other metrics?




Usage of variablesData processing


tions

Yury Lifshits










Further Research

Summary


Other metrics?




Usage of variablesData processingControl flow commands


tions

Yury Lifshits










Further Research

Summary


Other metrics?





➯ Code patterns


tions

Yury Lifshits










Further Research

Summary


Other metrics?





➯ Code patternsDestroy long patterns in program


tions

Yury Lifshits










Further Research

Summary


tions

Yury Lifshits










Further Research

Summary

Control Flow Model I

What is program from our point of view?


tions

Yury Lifshits










Further Research

Summary

Control Flow Model II


tions

Yury Lifshits










Further Research

Summary


Compilers and program optimization theory representprograms by control flow graph (CFG)

➯ Each node in the graph represents a basic block


tions

Yury Lifshits










Further Research

Summary




➯ Basic block: straight-line piece of code without anyjumps or jump targets


tions

Yury Lifshits










Further Research

Summary





➯ Directed edges are used to represent jumps in thecontrol flow


tions

Yury Lifshits










Further Research

Summary





➯ Directed edges are used to represent jumps in thecontrol flow

➯ Jump targets start a block; jumps end a block


tions

Yury Lifshits










Further Research

Summary

Simple transformations

So what transformations do you can suggest?


tions

Yury Lifshits










Further Research

Summary



➯ Data Obfuscation


tions

Yury Lifshits










Further Research

Summary



➯ Data ObfuscationVariable splitting


tions

Yury Lifshits










Further Research

Summary



➯ Data ObfuscationVariable splittingScalar/objectconversion


tions

Yury Lifshits










Further Research

Summary



➯ Data ObfuscationVariable splittingScalar/objectconversionStatic data to procedure


tions

Yury Lifshits










Further Research

Summary



➯ Data ObfuscationVariable splittingScalar/objectconversionStatic data to procedureChange variable lifetime


tions

Yury Lifshits










Further Research

Summary



➯ Data ObfuscationVariable splittingScalar/objectconversionStatic data to procedureChange variable lifetimeSplit/fold/merge arrays


tions

Yury Lifshits










Further Research

Summary



➯ Data ObfuscationVariable splittingScalar/objectconversionStatic data to procedureChange variable lifetimeSplit/fold/merge arraysChange encoding


tions

Yury Lifshits










Further Research

Summary



➯ Data ObfuscationVariable splittingScalar/objectconversionStatic data to procedureChange variable lifetimeSplit/fold/merge arraysChange encodingMerge scalar variables


tions

Yury Lifshits










Further Research

Summary




➯ Control Obfuscation


tions

Yury Lifshits










Further Research

Summary




➯ Control ObfuscationBreak basic blocks


tions

Yury Lifshits










Further Research

Summary




➯ Control ObfuscationBreak basic blocksInline methods


tions

Yury Lifshits










Further Research

Summary




➯ Control ObfuscationBreak basic blocksInline methodsOutline statements


tions

Yury Lifshits










Further Research

Summary




➯ Control ObfuscationBreak basic blocksInline methodsOutline statementsUnroll loops


tions

Yury Lifshits










Further Research

Summary




➯ Control ObfuscationBreak basic blocksInline methodsOutline statementsUnroll loopsReorderstatements


tions

Yury Lifshits










Further Research

Summary




➯ Control ObfuscationBreak basic blocksInline methodsOutline statementsUnroll loopsReorderstatementsReorder loops


tions

Yury Lifshits










Further Research

Summary

Control Flow Flattening

How to destroy control flow graph?


tions

Yury Lifshits










Further Research

Summary



Step by step:

➯ Write down a list of all basic blocks


tions

Yury Lifshits










Further Research

Summary



Step by step:


➯ Split and merge some of them


tions

Yury Lifshits










Further Research

Summary



Step by step:



➯ Enumerate them


tions

Yury Lifshits










Further Research

Summary



Step by step:



➯ Enumerate them

➯ Replace all calls by indirect pointing


tions

Yury Lifshits










Further Research

Summary



Step by step:



➯ Enumerate them

➯ Replace all calls by indirect pointing

➯ Write a single dispatcher to maintain all control flow


tions

Yury Lifshits










Further Research

Summary

Opaque predicates

How can we use IF operator for obfuscation?


tions

Yury Lifshits










Further Research

Summary

Opaque predicates


Opaque predicates: every time the same valueDifficult to discover by automatical static analysis


tions

Yury Lifshits










Further Research

Summary

Opaque predicates



Examples:

((q + q2) mod 2) = 0


tions

Yury Lifshits










Further Research

Summary

Opaque predicates



Examples:

((q + q2) mod 2) = 0

((q3) mod 8) = 0 OR ((q3) mod 8) = 1


tions

Yury Lifshits










Further Research

Summary

Functions Unifying

How can we make program proceduresindistinguishable?


tions

Yury Lifshits










Further Research

Summary

Functions Unifying


Procedures relations are expressed by Program Call Graph:procedures are nodes and procedure calls are directededges


tions

Yury Lifshits










Further Research

Summary

Functions Unifying



Idea: merge functions and call universal function withadditional parameterDifficulty: different signatures (input-output specifications)


tions

Yury Lifshits










Further Research

Summary

Functions Unifying



Idea: merge functions and call universal function withadditional parameterDifficulty: different signatures (input-output specifications)

Solution: unify signatures (in groups)


tions

Yury Lifshits










Further Research

Summary

Even more transformations

Question: Can you invent more?


tions

Yury Lifshits










Further Research

Summary



➯ Reuse identifiers


tions

Yury Lifshits










Further Research

Summary




➯ Introduce misleading comments :-)


tions

Yury Lifshits










Further Research

Summary





➯ Modify inheritance relations


tions

Yury Lifshits










Further Research

Summary






➯ Convert static data to procedural data


tions

Yury Lifshits










Further Research

Summary







➯ Store part of the program as a text and interpret it onlyduring runtime


tions

Yury Lifshits










Further Research

Summary







➯ Store part of the program as a text and interpret it onlyduring runtime

➯ Remove library calls


tions

Yury Lifshits










Further Research

Summary

Current Techniques: Pro and Contra

Advantages


tions

Yury Lifshits










Further Research

Summary


Advantages

✔ Easy to implement

✔ Universal

✔ Good against staticanalysis


tions

Yury Lifshits










Further Research

Summary


Advantages


✔ Universal


Disadvantages


tions

Yury Lifshits










Further Research

Summary


Advantages


✔ Universal


Disadvantages

✘ No guaranteed security


tions

Yury Lifshits










Further Research

Summary


Advantages


✔ Universal


Disadvantages


✘ Even no hope for that


tions

Yury Lifshits










Further Research

Summary


Advantages


✔ Universal


Disadvantages


✘ Even no hope for that

✘ Weak against dynamicattacks


tions

Yury Lifshits










Further Research

Summary

Classical Program Analysis

What’s about program analysis?


tions

Yury Lifshits










Further Research

Summary



Static analysis: only read codeDynamic analysis: execute code


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased

➯ Must be aliased


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased

➯ Must be aliased

➯ May be modified


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased

➯ Must be aliased

➯ May be modified

➯ Must be constant


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased

➯ Must be aliased

➯ May be modified


➯ Must be killed


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased

➯ Must be aliased

➯ May be modified


➯ Must be killed

➯ Must be available


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased

➯ Must be aliased

➯ May be modified


➯ Must be killed


➯ May be used before kill


tions

Yury Lifshits










Further Research

Summary




Usual tasks:

➯ May be aliased

➯ Must be aliased

➯ May be modified


➯ Must be killed


➯ May be used before kill

➯ May be referenced


tions

Yury Lifshits










Further Research

Summary

Is Deobfuscation Hard?

Can we prove the difficulty of deobfuscation?


tions

Yury Lifshits










Further Research

Summary



Not yet. But...


tions

Yury Lifshits










Further Research

Summary



Not yet. But...

We can prove program analysis to be hard for obfuscatedprograms:


tions

Yury Lifshits










Further Research

Summary



Not yet. But...

We can prove program analysis to be hard for obfuscatedprograms:

Alias analysis of obfuscated programs is NP-hard!


tions

Yury Lifshits










Further Research

Summary

Approaches to Deobfuscation

Almost all obfuscating transformations have a efficientdeobfuscating method...


tions

Yury Lifshits










Further Research

Summary



Do you believe?


tions

Yury Lifshits










Further Research

Summary



Do you believe?

Deobfuscator can use:

➯ Functions parameters catching


tions

Yury Lifshits










Further Research

Summary



Do you believe?



➯ Program slicing


tions

Yury Lifshits










Further Research

Summary



Do you believe?



➯ Program slicing

➯ Statistical analysis


tions

Yury Lifshits










Further Research

Summary



Do you believe?



➯ Program slicing


➯ Data flow analysis


tions

Yury Lifshits










Further Research

Summary



Do you believe?



➯ Program slicing


➯ Data flow analysis

➯ Pattern matching


tions

Yury Lifshits










Further Research

Summary

Further Research

What can we do here?


tions

Yury Lifshits










Further Research

Summary

Further Research


➯ Just new transformations


tions

Yury Lifshits










Further Research

Summary

Further Research



➯ Preventive transformations


tions

Yury Lifshits










Further Research

Summary

Further Research




➯ Protection against recompilation


tions

Yury Lifshits










Further Research

Summary

Further Research





➯ Introducing more deobufuscation hardness results


tions

Yury Lifshits










Further Research

Summary

Further Research





➯ Introducing more deobufuscation hardness results

Good Luck with this stuff!


tions

Yury Lifshits










Further Research

Summary

Summary

➯ Obfuscator analyse and modify program by series oftransformations


tions

Yury Lifshits










Further Research

Summary

Summary


➯ Obfuscating transformations consist of layout, data andcontrol tricks


tions

Yury Lifshits










Further Research

Summary

Summary



➯ Hardness of deobfuscation is not proved


tions

Yury Lifshits










Further Research

Summary

Summary



➯ Hardness of deobfuscation is not proved

Question Time!


tions

Yury Lifshits

Back UpSlidesNot covered by thetalk

References

Not covered by the talk

Obfuscation vs. watermarkingObfuscation for watermarkingMaking disassembling hard.Decompiled – uncompilable for JavaGeneral idea – make program dictionary as short aspossiblePreventive obfuscationProfiling in the obfuscatorReducible and non-reducible graphsAre obfuscating transformations comparable, e.g. one OT isevery time better than another OT?Program Analysis classification


tions

Yury Lifshits

Back UpSlidesNot covered by thetalk

References

For Further Reading

Collberg - Thomborson - LowSeries of papershttp://www.cs.arizona.edu/˜collberg/research/publications/

obfuscating transformations - yury lifshitsﬂow and basic blocks) makes some appropriateness...

Documents