Method and a device for automatically detecting control flow planarization

Abstract

The invention provides a method and a device for automatically detecting control flow planarization. The method comprises the following steps of: searching an intermediate dominating block for representing a node dominating relationship and a hierarchical relationship; constructing a dominating tree by taking all the found middle dominating blocks as nodes; determining dominating nodes on the basis of the constructed dominating tree; and calculating the control flow planarization similarity of the basic block dominated by the determined dominating node, and if the calculated similarity is greater than or equal to a set threshold value, judging that the code where the basic block is located is the code subjected to control flow planarization processing. The method provided by the invention is simple and effective, can be realized in a reverse tool of a mainstream, helps a reverse engineer to quickly position and remove control flow planarization, and restores an original control flow structure of a code.

Description

technical field [0001] The invention relates to the technical field of code analysis, in particular to a control flow flattening automatic detection method and device. Background technique [0002] Authors of commercial software and malware often use code obfuscation to protect specific blocks of code from reverse engineering the logic of the code. Generally speaking, knowing which piece of code uses obfuscation technology can be used as a starting point to conduct a more detailed and in-depth analysis of this piece of code. Control flow flattening is one of the most popular obfuscation techniques. Without changing the function of the source code, it converts the sequential control flow in the code into a jump control flow, eliminates the sequence of execution between basic blocks, and converts the basic Blocks are placed under the same hierarchy for display. [0003] In the field of reverse engineering, it is popular to study how to generate obfuscated code, how to remove...

AI Technical Summary

Problems solved by technology

[0003] In the field of reverse engineering, it is popular to study how to generate obfuscated code, how to remove obfuscated code, and restore the original control flow. However, there are still relatively few public methods on how to detect which piece of code uses which obfuscation technology.

Existing methods discuss how to obtain real blocks, preambles, and useless blocks for obfuscated code, and do not explain how to determine the location of obfuscated code

Images