Binary Obfuscation Using Signals

Igor V. Popov ( University of Arizona)

Saumya K. Debray (University of Arizona)

Gregory R. Andrews (University of Arizona)

Presented by Ming Jiang

Introduction

This paper addresses the problem of making it hard to reverse engineering binary programs by making it difficult to disassemble binary code statically.

Binaries are obfuscated by changing many control transfers into signals (traps) and inserting bogus control transfers and “junk” instructions after the signals.

Binary Obfuscation Using Signals2

Two Assumptions By Disassemble

1. the address where each instruction begins can be determined;

2. control transfer instructions can be identified and their targets determined.

This paper shows how the second of these assumptions can be violated, such that actual control transfers in the program cannot be identified by a static disassembler.

Binary Obfuscation Using Signals3

Two Disassembly Algorithms

Linear sweep: The linear sweep algorithm begins disassembly at the input program's first executable location, and simply sweeps through the entire text section disassembling each instruction as it is encountered.

E.g., GNU Utility – Objdump Recursive traversal: starts at the program's

main entry point and proceeds by following each branch instruction encountered in a depth-first or breadth-first manner. E.g., IDA Pro

Neither approach is 100% precise. Binary Obfuscation Using Signals

4

Overview

Binary Obfuscation Using Signals5

Key Aspects of the Approach

1. A variety of different instructions and addresses can be used to raise a signal at runtime. mprotect() change protection

2. The address used to generate the trap need not be a determinate value.

Binary Obfuscation Using Signals6

Key Aspects of the Approach

3. A variety of different traps can be used.

SIGFPE floating point exception

SIGILL illegal instruction

SIGSEGV illegal memory usage

4. The location following the trap-generating instruction is unreachable, but this is not evident from standard control flow analyses.

Binary Obfuscation Using Signals7

Flip Conditional Branches

Binary Obfuscation Using Signals8

This transformation increasing the set of candidate locations where obfuscation can be applied.

Inserting Bogus Code

confuse the control flow analysis of the program improve the stealthiness of the obfuscation

Binary Obfuscation Using Signals9

Signal Handing– Normal Case

Binary Obfuscation Using Signals10

Signal Handing– Obfuscated Case

Binary Obfuscation Using Signals11

Evaluation Metric

Obfuscations are evaluated with respect to: Potency (disassembly errors) -To what degree is a

human reader confused Resilience (control flow errors) -How well are

automatic deobfuscation attacks resisted Cost-How much time/space overhead is added Stealth-How well does obfuscated code blend in

with the original code. Whether the obfuscation process introduces any atypical instruction sequence signatures that could be used to identify the obfuscation code statically.

Binary Obfuscation Using Signals12

The IDA Pro, which is considered the best commercial disassembler, fails to disassemble 57% of the original instructions, over-reports control flow edges by 41%.

However, obfuscation method slows down program execution because of signal processing overhead, the average slow-down is 21%.

Binary Obfuscation Using Signals13

Distribution of Individual Opcodes

Binary Obfuscation Using Signals14

Distribution of Opcode Pairs

Binary Obfuscation Using Signals15

16

Questions?

Thank you