Sökning: onr:"swepub:oai:DiVA.org:liu-188915" >
desync-cc: An Autom...
-
Kargén, Ulf,Doktor,1984-Linköpings universitet,Databas och informationsteknik,Tekniska fakulteten
(författare)
desync-cc: An Automatic Disassembly-Desynchronization Obfuscator
- Artikel/kapitelEngelska2022
Förlag, utgivningsår, omfång ...
-
IEEE Computer Society,2022
-
printrdacarrier
Nummerbeteckningar
-
LIBRIS-ID:oai:DiVA.org:liu-188915
-
https://urn.kb.se/resolve?urn=urn:nbn:se:liu:diva-188915URI
-
https://doi.org/10.1109/SANER53432.2022.00063DOI
Kompletterande språkuppgifter
-
Språk:engelska
-
Sammanfattning på:engelska
Ingår i deldatabas
Klassifikation
-
Ämneskategori:ref swepub-contenttype
-
Ämneskategori:kon swepub-publicationtype
Anmärkningar
-
Code obfuscation is an important topic, both in terms of defense, when trying to prevent intellectual property theft, and from the offensive point of view, when trying to break obfuscation used by malware authors to hide their malicious intents. Consequently, several works in recent years have discussed techniques that aim to prevent or delay reverse-engineering of binaries. While most works focus on methods that obscure the program logic from potential attackers, the complimentary approach of disassembly desynchronization has received relatively little attention. This technique puts another hurdle in the way of attackers by targeting the most fundamental step of the reverse-engineering process: recovering assembly code from a program binary. The technique works by tricking a disassembler into decoding the instruction stream at an invalid offset. On CPU architectures with variable-length instructions, this often yields valid albeit meaningless assembly code, while hiding a part of the original code.In the interest of furthering research into disassembly desynchronization, both from a defensive and offensive point of view, we have created desync-cc, a tool for automatic application of disassembly-desynchronization obfuscation. The tool is designed as a drop-in replacement for gcc, and works by intercepting and modifying intermediate assembly code during compilation. By applying obfuscation after the code generation phase, our tool allows a much more granular control over where obfuscation is applied, compared to a source-code level obfuscator. In this paper, we describe the design and implementation of desync-cc, and present a preliminary evaluation of its effectiveness and efficiency on a number of real-world Linux programs.
Ämnesord och genrebeteckningar
Biuppslag (personer, institutioner, konferenser, titlar ...)
-
Härnqvist, IvarLinköpings universitet(Swepub:liu)n/a
(författare)
-
Wilson, JohannesLinköpings universitet(Swepub:liu)n/a
(författare)
-
Eriksson, GustavLinköpings universitet(Swepub:liu)n/a
(författare)
-
Holmgren, EvelinaLinköpings universitet(Swepub:liu)n/a
(författare)
-
Shahmehri, Nahid,Professor,1952-Linköpings universitet,Databas och informationsteknik,Tekniska fakulteten(Swepub:liu)nahsh37
(författare)
-
Linköpings universitetDatabas och informationsteknik
(creator_code:org_t)
Sammanhörande titlar
-
Ingår i:2022 IEEE International Conference on Software Analysis, Evolution and Reengineering: IEEE Computer Society, s. 464-4689781665437868
Internetlänk
Hitta via bibliotek
Till lärosätets databas