Hidden System APIs Based Code Obfuscation

Abstract:

For the problem that static disassembly can expose system API calls in programs, this paper proposes a kind of code obfuscation aimed at hiding system API calls from reverse analysis. The algorithm is implemented by creating a system API address table and constructing secret index variables. During execution, the program looks up the table for the correct API to call, thus keeping the semantic unchanged. Analysis and experiments show that the algorithm can effectively protect system API calls from static reverse analysis.

• Periodical: Applied Mechanics and Materials (Volume 743)
• Pages: 496-502
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.743.496
• Online since: March 2015
• Authors: Fei Xiang*, Fen Lin Liu, Bin Lu, Dao Fu Gong
• Keywords: Code Obfuscation, Reverse Analysis, Static Disassembly, System API Address Table

References

[1] Collberg C. S., Thomborson C., Low D.: A taxonomy of obfuscating transformations,. Techical report 148, Department of Computer Science, University of Auckland, Auckland, NewZealand, (1997).

[2] Collberg C, Thomborson C, Low D. Manufacturing cheap, resilient, and stealthy opaoue constructs. In: Proc. of the 25th ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages, 1998. 184 196.

DOI: 10.1145/268946.268962

[3] Wang C., Hill J., Knight J., et al.: Software tamper resistance: Obstructing static analysis of programs,. Technical report 12, Department of Computer Science, University of Virginia, (2000).

[4] Chow S, Gu Y, Johnson H, Zakharov VA. An approach to the obfuscation of control-flow of sequential computer programs. In: Davida G, Frankel Y, eds. Proc. of the Information Security (ISC 2001). LNCS 2200, Springer-Verlag, 2001. 144 155.

DOI: 10.1007/3-540-45439-x_10

[5] Charles LeDoux, Michael Sharkey, Brandon Primeaux, Craig Miles. Instruction Embedding for Improved Obfuscation. ACM SE 12 (2012).

DOI: 10.1145/2184512.2184543

[6] Balachandran V. and Emmanuel S.: Potent and Stealthy Control Flow Obfuscation by Stack Based Self-Modifying Code,. IEEE Trans. Inf. Foren. Sec., 2013, 8, (4), pp.669-681.

DOI: 10.1109/tifs.2013.2250964

[7] Sebastian Schrittwieser, Stefan Katzenbeisser, Peter Kieseberg, Markus Huber, Manuel Leithner, Martin Mulazzani, Edgar Weippl. Covert Computation — Hiding code in code through compile-time obfuscation. Computers & Security, Volume 42, May 2014, Pages 13-26.

DOI: 10.1016/j.cose.2013.12.006

[8] Kulkarni A, Metta R. A New Code Obfuscation Scheme for Software Protection[C]/Service Oriented System Engineering (SOSE), 2014 IEEE 8th International Symposium on. IEEE, 2014: 409-414.

DOI: 10.1109/sose.2014.57

[9] CHOW S，GU Y，JOHNSON H，et al． An approach to the obfuscation of control-flow of sequential computer programs［C］/ /Proc of the 4th International Conference on Information Security． London: Springer-Verlag，2001: 144-155.

DOI: 10.1007/3-540-45439-x_10

[10] Xie X, Liu F, Lu B. A Data Obfuscation Based on State Transition Graph of Mealy Automata[M]/Intelligent Computing Theory. Springer International Publishing, 2014: 520-531.

DOI: 10.1007/978-3-319-09333-8_58