基于动态符号执行的不透明谓词反混淆算法

Opaque Predicate De-Obfuscation Scheme Based on Dynamic Symbolic Execution

恶意软件、漏洞利用程序等层出不穷,这些程序通常会利用代码混淆来增加其分析难度,以此来延长生存周期。不透明谓词混淆是代码混淆中的主要方法之一。目前通过数据流分析消除程序中的不可达路径是不透明谓词的主要反混淆方法。文章提出一种基于动态符号执行的路径不可达分析的不透明谓词反混淆算法,通过控制流图分析得到每个函数的基本块,然后对含有分支的基本块进行路径可达性分析,去除不可达路径。原型系统实验结果表明,该算法的平均反混淆率在80%左右。

Malicious software and vulnerability exploitprograms emerge endlessly. They usually extend the life cycle by using obfuscated code and hence increase the difficulty to beanalyzed. The opaque predicate obfuscation is one of the main ways for code obfuscation. At present,the main de-obfuscating method for opaque predicates is to eliminate the unreachable path in the program through data flow analysis. This paper presents a scheme of path unreachability analysis on opaque predicate de-obfuscationbased on dynamic symbolic execution. Each function is obtained by control flow graph analysis of basic block. As for the path containing branches of basic block,the accessibility is analyzed and the inaccessiblepaths are eliminated. By analyzing the path reachability of branches,we can determine the true branches that will be executed. Our experiment result shows that the average de-obfuscation rate is at around 80%.