Abstract:Java bytecode is a quite high-level language and, as such, it is fairly easy to analyze and decompile with malicious intents, e.g., to tamper with code and skip license checks. Code obfuscation was a first attempt to mitigate malicious reverse engineering based on static analysis. However, obfuscated code can still be dynamically analyzed with standard debuggers to perform step-wise execution and to inspect (or change) memory content at important execution points, e.g., to alter the verdict of license validity checks. Although some approaches have been proposed to mitigate debugger-based attacks, they are only applicable to binary compiled code and none address the challenge of protecting Java bytecode. In this paper, we propose a novel approach to protect Java bytecode from malicious debugging. Our approach is based on automated program transformation to manipulate Java bytecode and split it into two binary processes that debug each other (i.e., a self-debugging solution). In fact, when the debugging interface is already engaged, an additional malicious debugger cannot attach. To be resilient against typical attacks, our approach adopts a series of technical solutions, e.g., an encoded channel is shared by the two processes to avoid leaking information, an authentication protocol is established to avoid Man-in-the-Middle attacks and the computation is spread between the two processes to prevent the attacker to replace or terminate either of them. We test our solution on 18 real-world Java applications, showing that our approach can effectively block the most common debugging tasks (either with the Java debugger or the GNU debugger) while preserving the functional correctness of the protected programs. While the final decision on when to activate this protection is still up to the developers, the observed performance overhead was acceptable for common desktop application domains.

Rule (4) and Continuous Observation

An Instrumentation Tool for Program Dynamic Analysis in Java

Log-based Architectures for General-Purpose Monitoring of Deployed Code

Dynamic Taint Tracking using Partial Instrumentation for Java Applications

A Source-Level Instrumentation Framework for the Dynamic Analysis of Memory Safety

Flexible Non-intrusive Dynamic Instrumentation for WebAssembly

Program Instrumentation In Computer Monitoring

Past: Accurate Instrumentation on Fully Optimized Program

ODIN: On-Demand Instrumentation with On-the-Fly Recompilation

Pin: building customized program analysis tools with dynamic instrumentation

Firmware code instrumentation technology for internet of things-based services

A declarative approach for Java code instrumentation

Examem: Low-Overhead Memory Instrumentation for Intelligent Memory Systems

Runtime-Adaptable Selective Performance Instrumentation

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

Mtool: an integrated system for performance debugging shared memory multiprocessor applications

Mitigating Debugger-based Attacks to Java Applications with Self-Debugging

JITScanner: Just-in-Time Executable Page Check in the Linux Operating System

Redundancy Suppression In Time-Aware Dynamic Binary Instrumentation

On Code Execution Tracking Via Power Side-Channel

ROPocop - Dynamic Mitigation of Code-Reuse Attacks