Abstract:Java bytecode is a quite high-level language and, as such, it is fairly easy to analyze and decompile with malicious intents, e.g., to tamper with code and skip license checks. Code obfuscation was a first attempt to mitigate malicious reverse engineering based on static analysis. However, obfuscated code can still be dynamically analyzed with standard debuggers to perform step-wise execution and to inspect (or change) memory content at important execution points, e.g., to alter the verdict of license validity checks. Although some approaches have been proposed to mitigate debugger-based attacks, they are only applicable to binary compiled code and none address the challenge of protecting Java bytecode. In this paper, we propose a novel approach to protect Java bytecode from malicious debugging. Our approach is based on automated program transformation to manipulate Java bytecode and split it into two binary processes that debug each other (i.e., a self-debugging solution). In fact, when the debugging interface is already engaged, an additional malicious debugger cannot attach. To be resilient against typical attacks, our approach adopts a series of technical solutions, e.g., an encoded channel is shared by the two processes to avoid leaking information, an authentication protocol is established to avoid Man-in-the-Middle attacks and the computation is spread between the two processes to prevent the attacker to replace or terminate either of them. We test our solution on 18 real-world Java applications, showing that our approach can effectively block the most common debugging tasks (either with the Java debugger or the GNU debugger) while preserving the functional correctness of the protected programs. While the final decision on when to activate this protection is still up to the developers, the observed performance overhead was acceptable for common desktop application domains.

Anti-Reverse-Engineering Tool of Executable Files on the Windows Platform

Defense of Hidden Backdoor Technology for Web

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

EXAMINER-PRO: Testing Arm Emulators Across Different Privileges

Dynamic Analysis and Debugging of Binary Code for Security Applications

NCScope: Hardware-Assisted Analyzer for Native Code in Android Apps

POSTER : PT-DBG : Bypass Anti-debugging with Intel Processor Tracing

Supporting secure programming in web applications through interactive static analysis.

Anti-key Logger Based on Hardware-assisted Virtualization

Extended Report on the Obfuscated Integration of Software Protections

Unmasking the Shadows: Pinpoint the Implementations of Anti-Dynamic Analysis Techniques in Malware Using LLM

Study of the Influence of Anti-analysis Techniques on the Security of Android Ecosystem

A Dynamic Detection Method Against ROP and JOP

APPROACH FOR DETECTING ANTI-ANALYSIS MALWARE

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

TEE-aided Write Protection Against Privileged Data Tampering

Instantly Obsoleting the Address-code Associations: A New Principle for Defending Advanced Code Reuse Attack

EShield: Protect Smart Contracts Against Reverse Engineering

Mitigating Debugger-based Attacks to Java Applications with Self-Debugging

A practical approach for finding anti-debugging routines in the Arm-Linux using hardware tracing

The Reversing Machine: Reconstructing Memory Assumptions