Abstract:Control-flow obfuscation increases program complexity by semantic-preserving transformation. Opaque predicates are essential gadgets to achieve such transformation. However, we observe that real-world opaque predicates are generally very simple and engage little security consideration. Recently, such insecure opaque predicates have been severely attacked by symbolic execution-based adversaries and jeopardize the security of control-flow obfuscation. This paper, therefore, proposes symbolic opaque predicates which can be resilient to symbolic execution-based adversaries. We design a general framework to compose such opaque predicates, which requires introducing challenging symbolic analysis problems (e.g., symbolic memory) in each opaque predicate. In this way, we may mislead symbolic execution engines into reaching false conclusions. We observe a novel bi-opaque property about symbolic opaque predicates, which can incur not only false negative issues but also false positive issues to attackers. To evaluate the efficacy of our idea, we have implemented a prototype obfuscation tool based on Obfuscator-LLVM and conduct experiments with real-world programs. Our evaluation results show that symbolic opaque predicates demonstrate excellent resilience to prevalent symbolic execution engines, such as BAP, Triton, and Angr. Moreover, although the costs of symbolic opaque predicates may vary for different problem settings, some predicates can be very efficient. Therefore, our framework is both secure and usable. Users can follow the framework to introduce symbolic opaque predicates into their obfuscation tools and made them more powerful.

Defeating MBA-based Obfuscation

Simplifying MBA Expression Using E-Graphs

Simplification of General Mixed Boolean-Arithmetic Expressions: GAMBA

Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions

Deobfuscation of Semi-Linear Mixed Boolean-Arithmetic Expressions

SSLEM: A Simplifier for MBA Expressions based on Semi-linear MBA Expressions and Program Synthesis

Toward a Formal and Quantitative Evaluation Framework for Circuit Obfuscation Methods

Obfuscation using Encryption

How to Kill Symbolic Deobfuscation for Free; or Unleashing the Potential of Path-Oriented Protections

On Secure and Usable Program Obfuscation: A Survey

Manufacturing Resilient Bi-Opaque Predicates Against Symbolic Execution

Secure and Low-Overhead Circuit Obfuscation Technique with Multiplexers

Manufacturing Cheap, Resilient, and Stealthy Opaque Constructs.

Layered Obfuscation: a Taxonomy of Software Obfuscation Techniques for Layered Security.

Specifying Imperative Data Obfuscations

Exploring Compiler Optimization Space for Control Flow Obfuscation

Algorithmic Obfuscation over GF($2^m$)

Benchmarking Obfuscators of Functionality.

Translingual Obfuscation

Misleading Malware Similarities Analysis By Automatic Data Structure Obfuscation

A Taxonomy of Obfuscating Transformations