deobfuscation
573060
Deobfuscation: reverse engineering obfuscated code
In recent years, code obfuscation has attracted attention as a low cost approach to improving software security by making it difficult for attackers to understand the inner workings of proprietary software systems. This paper examines techniques for automatic deobfuscation of obfuscated programs, as a step towards reverse engineering such programs. Our results indicate that much of the effects of code obfuscation, designed to increase the difficulty of static analyses, can be defeated using simple combinations of straightforward static and dynamic analyses. Our results have applications to both software engineering and software security. In the context of software engineering, we show how dynamic analyses can be used to enhance reverse engineering, even for code that has been designed to be difficult to reverse engineer. For software security, our results serve as an attack model for code obfuscators, and can help with the development of obfuscation techniques that are more resilient to straightforward reverse engineering.
12th Working Conference on Reverse Engineering (WCRE'05)
Sharath K Udupa Saumya K Debray Matias Madou
9490585
Deobfuscation of virtualization obfuscated software: a semantics based approach
When new malware are discovered, it is important for researchers to analyze and understand them as quickly as possible. This task has been made more difficult in recent years as researchers have seen an increasing use of virtualization obfuscated malware code. These programs are difficult to comprehend and reverse engineer, since they are resistant to both static and dynamic analysis techniques. Current approaches to dealing with such code first reverse engineer the byte code interpreter, then use this to work out the logic of the byte code program. This outside in approach produces good results when the structure of the interpreter is known, but cannot be applied to all cases. This paper proposes a different approach to the problem that focuses on identifying instructions that affect the observable behavior of the obfuscated code. This inside out approach requires fewer assumptions, and aims to complement existing techniques by broadening the domain of obfuscated programs eligible for automated analysis. Results from a prototype tool on real world malicious code are encouraging.
CCS '11
Kevin Coogan Gen Lu Saumya K Debray
18882938
Statistical Deobfuscation of Android Applications
This work presents a new approach for deobfuscating Android APKs based on probabilistic learning of large code bases (termed "Big Code" The key idea is to learn a probabilistic model over thousands of non obfuscated Android applications and to use this probabilistic model to deobfuscate new, unseen Android APKs. The concrete focus of the paper is on reversing layout obfuscation, a popular transformation which renames key program elements such as classes, packages, and methods, thus making it difficult to understand what the program does. Concretely, the paper: (i) phrases the layout deobfuscation problem of Android APKs as structured prediction in a probabilistic graphical model, (ii) instantiates this model with a rich set of features and constraints that capture the Android setting, ensuring both semantic equivalence and high prediction accuracy, and (iii) shows how to leverage powerful inference and learning algorithms to achieve overall precision and scalability of the probabilistic predictions. We implemented our approach in a tool called DeGuard and used it to: (i) reverse the layout obfuscation performed by the popular ProGuard system on benign, open source applications, (ii) predict third party libraries imported by benign APKs (also obfuscated by ProGuard) and (iii) rename obfuscated program elements of Android malware. The experimental results indicate that DeGuard is practically effective: it recovers 79.1% of the program element names obfuscated with ProGuard, it predicts third party libraries with accuracy of 91.3% and it reveals string decoders and classes that handle sensitive data in Android malware.
CCS
Benjamin Bichsel Veselin Raychev Petar Tsankov Martin T Vechev
16936908
A Generic Approach to Automatic Deobfuscation of Executable Code
Malicious software are usually obfuscated to avoid detection and resist analysis. When new malware is encountered, such obfuscations have to be penetrated or removed "deobfuscated" in order to understand the internal logic of the code and devise countermeasures. This paper discusses a generic approach for deobfuscation of obfuscated executable code. Our approach does not make any assumptions about the nature of the obfuscations used, but instead uses semantics preserving program transformations to simplify away obfuscation code. We have applied a prototype implementation of our ideas to a variety of different kinds of obfuscation, including emulation based obfuscation, emulation based obfuscation with runtime code unpacking, and return oriented programming. Our experimental results are encouraging and suggest that this approach can be effective in extracting the internal logic from code obfuscated using a variety of obfuscation techniques, including tools such as Themida that previous approaches could not handle.
2015 IEEE Symposium on Security and Privacy
Babak Yadegari Brian Johannesmeyer Ben Whitely Saumya K Debray
9432458
Deobfuscation is in NP
There are two important problems in the security of mobile programs: protecting the host computer from the program, and protecting the program from the host computer. For the first problem, many successful techniques apply from virtual memory protection to type checking and even proof carrying code. But the second problem seems harder: computing a result "in full sight" of the host computer while keeping the algorithms or intermediate results secret. Protection of programs from hosts has many applications; a typical application is in "digital rights management," where it is desired (for example) to permit the decryption of a document for display on the screen but not for copying or printing. The display program must somehow hide the decryption key from the prying eyes of the host computer and operating system. Every part of a typical personal computer is accessible to the person who has physical possession of it. This means the user can read the disk drive, can insert emulation layers to debug or analyze the execution of the program, and so on. Under such circumstances, protection is difficult indeed. Some work in this area assumes the use of a secure processor (or coprocessor) that can do computations that are not physically accessible to the user [3, 2] Such approaches can be made as strong as public key encryption, and appear to have significant promise. However, much of the work in program protection is meant to be applicable on conventional, general purpose PCs, and does not rely on special hardware. The algorithms used are generally called "code obfuscation;" they rearrange the protected program to make their control
Andrew W Appel
8595492
Automatic binary deobfuscation
This paper gives an overview of our research in the automation of the process of software protection analysis. We will focus more particularly on the problem of obfuscation. Our current approach is based on a local semantic analysis, which aims to rewrite the binary code in a simpler (easier to understand) way. This approach has the advantage of not relying on a manual search for "patterns" of obfuscation. This way of manipulating the code is, at the end, quite similar to the optimising stage of most of compilers. We will exhibit concrete results based on the development of a prototype and its application to a test target. Current limitations and future prospects will be discussed in as well.
Journal in Computer Virology
Yoann Guillot Alexandre Gazet
18823369
Deobfuscation: Improving reverse engineering of obfuscated code
In recent years, code obfuscation has attracted attention as a low cost approach to improving software security by making it difficult for attackers to understand the inner workings of proprietary software systems. This paper examines the extent to which current obfuscation techniques succeed in making programs harder to reverse engineer. Our results indicate that many obfuscations, designed to increase the difficulty of static analyses, are easily defeated using simple combinations of straightforward static and dynamic analyses. Our results have applications to both software engineering and software security. In the context of software engineering, we show how dynamic analyses can be used to enhance reverse engineering, even for code that has been designed to be difficult to reverse engineer. For software security, our results serve as an attack model for code obfuscators, and can help with the development of obfuscation techniques that are more resilient to straightforward reverse engineering.
Sanjay Chandrasekharan Saumya K Debray
11497645
Spam Deobfuscation using a Hidden Markov Model
To circumvent spam filters, many spammers attempt to obfuscate their emails by deliberately misspelling words or introducing other errors into the text. For example viagra may be written vigra, or mortgage written m0rt gage. Even though humans have little difficulty reading obfuscated emails, most content based filters are unable to recognize these obfuscated spam words. In this paper, we present a hidden Markov model for deobfuscating spam emails. We empirically demonstrate that our model is robust to many types of obfuscation including misspellings, incorrect segmentations (adding/removing spaces) and substitutions/insertions of non alphabetic characters.
CEAS
Honglak Lee A Ng
62474649
Dynamic Binary Instrumentation for Deobfuscation and Unpacking
We propose to extend the toolbox of reverse engineers beyond disassemblers, debuggers and emulators. Using dynamic binary instrumentation, it is very simple to write advanced tools such as automatic unpackers, system call tracers and deobfuscators. Based on our experiments, DBI is suitable for malware analysis. In this presentation, we will present a simple and accurate automatic unpacker integrated with IDA Pro and a Javascript deobfuscator, all written using DBI techniques.
Daniel Reynaud Jean-Yves Marion
15552623
Experiences in Malware Binary Deobfuscation
Malware authors employ a myriad of evasion techniques to impede automated reverse engineering and static analysis efforts. The most popular technologies include 'code obfuscators' that serve to rewrite the original binary code to an equivalent form that provides identical functionality while defeating signature based detection systems. These systems significantly complicate static analysis, making it challenging to uncover the malware intent and the full spectrum of embedded capabilities. While code obfuscation techniques are commonly integrated into contemporary commodity packers, from the perspective of a reverse engineer, deobfuscation is often a necessary step that must be conducted independently after unpacking the malware binary. In this paper, we describe a set of techniques for automatically unrolling the impact of code obfuscators with the objective of completely recovering the original malware logic. We have implemented a set of generic debofuscation rules as a plug in for the popular IDA Pro disassembler. We use sophisticated obfuscation strategies employed by two infamous malware instances from 2009, Conficker C and Hydraq (the binary associated with the Aurora attack) as case studies. In both instances our deobfuscator enabled a complete decompilation of the underlying code logic. This work was instrumental in the comprehensive reverse engineering of the heavily obfuscated P2P protocol embedded in the Conficker worm. The plug in is integrated with the HexRays decompiler to provide a complete reverse engineering of malware binaries from binary form to C code and is available for free download on the SRI malware threat center website: http:/www.mtc.sri.com/deobfuscation/
Hassen Saidi Phillip A Porras Vinod Yegneswaran