Multi-code transformation method and apparatus for binary obfuscation

Abstract

The objective of the present invention is to prevent reverse engineering of a program and enhance resistance to an analysis tool. Provided is a multi-code transformation method for binary obfuscation, comprising: a first obfuscation step of reconstructing a source code into a plurality of executable basic blocks; a second obfuscation step of inserting at least one fake basic block among the executable basic blocks; and a third obfuscation step of inserting a junk code into each of the executable basic block and the fake basic blocks, wherein the executable basic block includes at least one switch-case statement representing at least some statements of the source code.

Description

Multi-code conversion method and device for binary obfuscation

[0001] The present invention relates to an obfuscation technique, and more specifically, to a multi-code conversion method and apparatus for binary obfuscation.

[0002] Binary obfuscation is a technique that makes it difficult to reverse engineer or analyze programs by complexly modifying the structure or instructions of executable files (binaries). It is utilized in areas such as commercial software protection and intellectual property protection, and plays a crucial role in fields requiring complex analysis. To make reverse engineering difficult, methods such as control flow obfuscation, opaque predicates, instruction substitution, code flattening, unnecessary code insertion, code virtualization, and analysis prevention techniques have been proposed.

[0003] However, while these techniques can effectively hinder reverse engineering when used independently, applying multiple obfuscation methods presents the problem of unexpected errors. For example, control flow obfuscation complexly modifies branch statements, and Opaque Predicates hinder analysis by inserting ambiguous conditions; however, when both techniques are applied simultaneously, they can cause code execution to become unnecessarily convoluted or lead to abnormal behavior.

[0004] As another example, when code flattening is combined with Opaque Predicates, complex control flow may be diverted to unintended paths, leading to unexpected behavior. Conflicts between these techniques cause program execution errors and significantly degrade software stability. Therefore, there is a need for obfuscation techniques that can increase the difficulty of program analysis by appropriately considering the interactions and conflicts between various obfuscation methods.

[0005] The present invention provides an obfuscation technique that combines control flow flattening, fake base block insertion, and junk code insertion to prevent reverse engineering of a program and enhance resistance to analysis tools.

[0006] The present invention provides an obfuscation technique that significantly increases the complexity of the control flow and allows for the adjustment of the difficulty of analysis by inserting blocks and instructions unrelated to the actual code.

[0007] The problems of the present invention are not limited to those mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the description below.

[0008] A multi-code conversion method for binary obfuscation according to one embodiment of the present invention is,

[0009] By an obfuscation unit that executes multiple obfuscation processes of different types in combination,

[0010] A first obfuscation step of reconstructing source code into multiple executable basic blocks;

[0011] A second obfuscation step of inserting at least one fake base block between the above executable base blocks; and

[0012] A third obfuscation step of inserting junk code into each of the above-mentioned executable base block and the above-mentioned fake base block; comprising,

[0013] The above executable basic block includes at least one switch-case statement that represents at least some statements of the source code.

[0014]

[0015] Preferably,

[0016] An IR generation step for generating an obfuscated intermediate language (IR: Intermediate Representation) using the executable base block with the aforementioned junk code inserted and the aforementioned fake base block; and

[0017] It further includes a binary code generation step of generating the obfuscated binary code from the obfuscated IR.

[0018]

[0019] Preferably,

[0020] The above first obfuscation step is,

[0021] A dispatcher block generation step for generating a dispatcher block that controls the execution flow of the above-mentioned executable basic blocks; and

[0022] It includes a control flow flattening step that reconstructs the executable basic blocks into a flattened structure by mapping each of the above executable basic blocks to the dispatcher block.

[0023]

[0024] Preferably,

[0025] The above second obfuscation step is,

[0026] It includes a Fake Basic Block Insertion step for inserting the Fake Basic Block by mapping the Fake Basic Block to the Dispatcher Block so that the Fake Basic Block and the executable Basic Blocks of the flattened structure are connected in parallel with respect to the Dispatcher Block.

[0027]

[0028] Preferably,

[0029] The above third obfuscation step is,

[0030] It includes a junk code insertion step that randomly inserts at least one instruction performing Add, Sub, Mul, Div, Xor, Not, and Or operations as the junk code into each of the executable base block and the fake base block.

[0031]

[0032] A multi-code conversion device for binary obfuscation according to another embodiment of the present invention is,

[0033] It includes an obfuscation unit that executes multiple obfuscation processes of different types in combination,

[0034] The above obfuscation part is,

[0035] A control flow flattening unit that reconstructs source code into multiple executable basic blocks;

[0036] A fake base block insertion unit that inserts at least one fake base block between the above-mentioned executable base blocks; and

[0037] A junk code insertion unit that inserts junk code into each of the above-mentioned executable base block and the above-mentioned fake base block; comprising

[0038] The above executable basic block includes at least one switch-case statement that represents at least some statements of the source code.

[0039]

[0040] Preferably,

[0041] An IR generation unit that generates an obfuscated Intermediate Representation (IR) using the executable base block with the aforementioned junk code inserted and the aforementioned fake base block; and

[0042] It further includes a binary code generation unit that generates the obfuscated binary code from the obfuscated IR.

[0043]

[0044] Preferably,

[0045] The above control flow flattening unit is,

[0046] A dispatcher block generating unit that generates a dispatcher block controlling the execution flow of the above-mentioned executable basic blocks; comprising

[0047] By mapping each of the above-mentioned executable basic blocks to the above-mentioned dispatcher block, the above-mentioned executable basic blocks are reconfigured into a flattened structure.

[0048]

[0049] Preferably,

[0050] The above fake basic block insertion part is,

[0051] The above fake basic block is mapped to the above dispatcher block so that the above fake basic block and the above executable basic blocks of the flattened structure are connected in parallel with respect to the above dispatcher block, and the above fake basic block is inserted.

[0052]

[0053] Preferably,

[0054] The above junk code insertion part is,

[0055] At least one instruction performing Add, Sub, Mul, Div, Xor, Not, and Or operations is randomly inserted into each of the above executable base block and the above fake base block as the above junk code.

[0056]

[0057] Specific details of other embodiments are included in the detailed description and drawings.

[0058] According to the multi-code conversion method and apparatus for binary obfuscation of the present invention, there is an advantage of being able to significantly increase the complexity of the control flow and increase the difficulty of analysis by inserting blocks and instructions unrelated to the actual code.

[0059] The multi-code conversion method and apparatus for binary obfuscation according to the present invention has the advantage that the user can control the complexity of the code flattening technique and the fake base block insertion technique.

[0060] However, the effects of the present invention are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art from the description below.

[0061] FIG. 1a is a schematic diagram of the configuration of a multi-code conversion device for binary obfuscation according to one embodiment of the present invention.

[0062] Figure 1b is a schematic diagram of the configuration of the obfuscation part of Figure 1a.

[0063] FIG. 2a is a conceptual diagram illustrating the operation of a control flow flattening unit according to an embodiment of the present invention.

[0064] FIG. 2b is a diagram conceptually illustrating the operation of a conventional control flow compared to FIG. 2a.

[0065] FIG. 3 is a conceptual diagram illustrating the operation of a fake basic block insertion part according to one embodiment of the present invention.

[0066] Figure 4a is a diagram showing a part of the code before the junk code insertion.

[0067] Figure 4b is a diagram showing the result of inserting junk code into the original code of Figure 4a.

[0068] FIG. 5 is a flowchart of a multi-code conversion method for binary obfuscation according to an embodiment of the present invention.

[0069] FIG. 6 is a drawing illustrating an exemplary computing device capable of implementing a device and / or system according to various embodiments of the present invention.

[0070]

[0071] The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below but may be implemented in various different forms. These embodiments are provided merely to ensure that the disclosure of the present invention is complete and to fully inform those skilled in the art of the scope of the invention, and the present invention is defined only by the scope of the claims. Throughout the specification, the same reference numerals refer to the same components.

[0072] The embodiments described herein will be described with reference to cross-sectional and / or plan views, which are exemplary illustrations of the invention. In the drawings, the thickness of the components is exaggerated for effective description of the technical content. Accordingly, the components illustrated in the drawings are schematic in nature, and the shapes of the components illustrated in the drawings are intended to illustrate specific forms of the components and are not intended to limit the scope of the invention. Although terms such as first, second, third, etc., have been used to describe various components in the various embodiments of this specification, these components should not be limited by such terms. These terms are used merely to distinguish one component from another. The embodiments described and illustrated herein also include their complementary embodiments.

[0073] The terms used herein are for describing the embodiments and are not intended to limit the invention. In this specification, the singular form includes the plural form unless specifically stated otherwise in the text. As used herein, "comprises" and / or "comprising" do not exclude the presence or addition of one or more other components, steps, actions, and / or elements to the mentioned components, steps, actions, and / or elements.

[0074] Unless otherwise defined, all terms used in this specification (including technical and scientific terms) may be used in a meaning commonly understood by those skilled in the art to which the present invention pertains. Additionally, terms defined in commonly used dictionaries are not to be interpreted ideally or excessively unless explicitly and specifically defined otherwise.

[0075] Hereinafter, the concept of the present invention and embodiments according thereto will be described in detail with reference to the drawings.

[0076] FIG. 1a is a schematic diagram of the configuration of a multi-code conversion device for binary obfuscation according to one embodiment of the present invention.

[0077] Code obfuscation is one of the most widely used application security techniques to protect applications from hacking. Code obfuscation involves modifying executable code so that it cannot be understood, interpreted, or executed. The source code itself is obfuscated, making it incomprehensible to third parties and allowing only execution.

[0078] The multi-code conversion device for binary obfuscation of the present invention includes an obfuscation unit (110), an IR generation unit (120), and a binary code generation unit (130).

[0079] The obfuscation unit (110) executes multiple obfuscation processes of different types by combining them.

[0080] In the present invention, the obfuscation unit (110) performs obfuscation on the source code by combining three different types: control flow flattening, fake basic block insertion, and junk code insertion.

[0081] The IR generation unit (120) generates an obfuscated intermediate language (IR: Intermediate Representation) using an executable base block with inserted junk code and a fake base block obtained through an obfuscation process that combines control flow flattening, fake base block insertion, and junk code insertion.

[0082] The IR generation unit (120) performs optimization on the blocks output from the obfuscation unit (110) to generate the final obfuscated IR.

[0083] The binary code generation unit (130) generates obfuscated binary code from the obfuscated IR.

[0084] In an embodiment that uses obfuscation to protect the source code of an embedded system, the binary code generation unit (130) converts the obfuscated IR into machine code suitable for the target machine.

[0085]

[0086] Figure 1b is a schematic diagram of the configuration of the obfuscation part of Figure 1a.

[0087] The present invention proposes an obfuscation technique that combines control flow flattening, fake base block insertion, and junk code insertion to prevent reverse engineering of a program and enhance resistance to analysis tools.

[0088] The obfuscation unit (110) of the present invention includes a control flow flattening unit (111) that reconstructs source code into a plurality of executable basic blocks, a fake basic block insertion unit (113) that inserts at least one fake basic block between executable basic blocks, and a junk code insertion unit (115) that inserts junk code into each of the executable basic block and the fake basic block.

[0089] Control Flow Flattening is a process of transforming a program's control flow from a simple sequential execution method into a flat structure. While conventional control flow has a clear flow based on multiple branch points and conditional statements, the present invention reconstructs the entire control flow into a single entry point (dispatcher block) and multiple executable blocks. Consequently, the execution order of the program analyzed by a reverse engineer becomes unclear, making control flow analysis difficult.

[0090] By the control flow flattening unit (111), all branch statements and loops of the program are converted into an indirect branching method based on state variables in a flattened state.

[0091] When control flow flattening is performed by the control flow flattening unit (111), the reverse engineer must perform a complex analysis of the entire code to identify the original execution flow, and the static analysis tool will not be able to recognize existing branch patterns.

[0092] The complexity of control flow flattening can be controlled by the user, allowing the level of obfuscation to be adjusted flexibly.

[0093] After the control flow is flattened, the fake basic block insertion unit (113) inserts a fake basic block that is not actually executed. The fake blocks are unrelated to the function of the actual program, but are designed to look like executable code, making it difficult for a reverse engineer to analyze.

[0094] The fake blocks inserted by the fake basic block insertion unit (113) are combined into the normal flow of the program and appear to be blocks that can actually be executed, but contain meaningless code.

[0095] It is difficult for reverse engineers to distinguish between fake blocks and actual executable blocks, and analysis tools end up recognizing the fake blocks as part of the actual program.

[0096] The number and complexity of fake blocks can be controlled by the user, allowing for flexible adjustment of the obfuscation level.

[0097] After inserting the fake base block, the junk code insertion unit (115) inserts junk code into each of the executable base block and the fake base block.

[0098] Junk code adds meaningless operations unrelated to the program's execution flow, which can reduce the efficiency of analysis due to the large number of unnecessary instructions.

[0099] Junk code consists of instructions that do not affect the program's execution flow, so it does not affect control flow flattening.

[0100] Junk code is randomly inserted from instructions that perform Add, Sub, Mul, Div, Xor, Not, and Or operations. To make it difficult to distinguish between fake and real blocks, junk code is designed to confuse reverse engineers analyzing the code flow by inserting the same number of instructions within the basic blocks.

[0101] The multi-code conversion method for binary obfuscation of the present invention combines control flow flattening, insertion of fake base blocks, and insertion of junk code to deform the control flow of a program and makes it difficult to analyze the software by inserting a large number of instructions and blocks unrelated to the actual executable code.

[0102]

[0103] FIG. 2a is a conceptual diagram illustrating the operation of a control flow flattening unit according to an embodiment of the present invention.

[0104] Control flow flattening is an obfuscation technique that maintains the program's functionality while increasing the complexity of core algorithms, thereby consuming a significant amount of time for static analysis.

[0105] Control flow flattening is a source code obfuscation technique that increases the complexity of algorithms to make static analysis difficult, while remaining functionally identical. To increase algorithm complexity, methods include converting source code into switch-case statements to divide the control flow into multiple stages, or converting various branching and loop statements into switch-case statements to increase the number of cases that need to be verified.

[0106] In one embodiment, the executable base block generated by control flow flattening includes at least one switch-case statement that represents at least some statements of the source code.

[0107] A control flow flattening unit that performs control flow flattening includes a dispatcher block generating unit that generates a dispatcher block that controls the execution flow of executable basic blocks.

[0108] The control flow flattening unit reconstructs the executable base blocks into a flattened structure by mapping each executable base block to a dispatcher block.

[0109] After reconstructing the base blocks into a flattened structure by control flow flattening, the execution of the base blocks is performed as follows: Dispatcher(210) -> BB1(221), BB1(221) -> Dispatcher(210), Dispatcher(210) -> BB2(222), BB2(222) -> Dispatcher(210), Dispatcher(210) -> BB3(223)

[0110]

[0111] FIG. 2b is a diagram conceptually illustrating the operation of a conventional control flow compared to FIG. 2a.

[0112] Unlike the control flow flattening of the present invention described with reference to FIG. 2a, the control flow of the basic block of the prior art is performed as BB1 (231) -> BB2 (232), BB2 (232) -> BB3 (233).

[0113]

[0114] FIG. 3 is a conceptual diagram illustrating the operation of a fake basic block insertion part according to one embodiment of the present invention.

[0115] The fake basic block insertion unit of the present invention maps the fake basic block to the dispatcher block and inserts the fake basic block so that the fake basic block and the executable basic blocks of the flattened structure are connected in parallel with respect to the dispatcher block.

[0116] As can be seen from the comparison between Fig. 3 and Fig. 2a, the fake base blocks (310, 320) are additionally mapped to the dispatcher block (210) through the fake base block insertion obfuscation process.

[0117] Through the insertion of fake base blocks, the executable base blocks (221, 222, 223) of the flattened structure and the fake base blocks (310, 320) are connected in parallel with respect to the dispatcher block.

[0118]

[0119] Figure 4a is a diagram showing a part of the code before the junk code insertion.

[0120] Junk code consists of instructions that do not affect the program's execution flow, so it does not affect control flow flattening.

[0121] In one embodiment, the junk code insertion unit randomly inserts at least one instruction that performs Add, Sub, Mul, Div, Xor, Not, and Or operations as junk code into each of the executable base block and the fake base block. FIG. 4a illustrates the code before the junk code insertion.

[0122]

[0123] Figure 4b is a diagram showing the result of inserting junk code into the original code of Figure 4a.

[0124]

[0125] FIG. 5 is a flowchart of a multi-code conversion method for binary obfuscation according to an embodiment of the present invention.

[0126] A multi-code conversion method for binary obfuscation according to one embodiment of the present invention is executed by an obfuscation unit that combines and executes a plurality of obfuscation processes of different types.

[0127] A multi-code conversion method for binary obfuscation according to one embodiment of the present invention

[0128] It includes a first obfuscation step (S510) for reconstructing source code into a plurality of executable base blocks, a second obfuscation step (S520) for inserting at least one fake base block between the executable base blocks, and a third obfuscation step (S530) for inserting junk code into each of the executable base blocks and the fake base blocks.

[0129] A multi-code conversion method for binary obfuscation according to one embodiment of the present invention further comprises an IR generation step of generating an obfuscated Intermediate Representation (IR) using an executable base block with inserted junk code and a fake base block, and a binary code generation step of generating an obfuscated binary code from the obfuscated IR.

[0130] In one embodiment, the first obfuscation step includes a dispatcher block generation step that generates a dispatcher block that controls the execution flow of executable base blocks; and a control flow flattening step that reconstructs the executable base blocks into a flattened structure by mapping each executable base block to the dispatcher block.

[0131] In one embodiment, the second obfuscation step includes a Fake Basic Block Insertion step for inserting a Fake Basic Block so that the Fake Basic Block and the executable Basic Blocks of the flattened structure are connected in parallel with respect to the Dispatcher Block by mapping the Fake Basic Block to the Dispatcher Block.

[0132] In one embodiment, the third obfuscation step includes a junk code insertion step that randomly inserts at least one instruction performing Add, Sub, Mul, Div, Xor, Not, and Or operations as junk code into each of the executable base block and the fake base block.

[0133]

[0134] FIG. 6 is a drawing illustrating an exemplary computing device capable of implementing a device and / or system according to various embodiments of the present invention.

[0135] Referring to FIG. 6, an exemplary computing device (600) capable of implementing devices according to some embodiments of the present disclosure will be described in more detail.

[0136] A computing device (600) may include one or more processors (610), a bus (650), a communication interface (670), a memory (630) for loading a computer program (691) executed by the processor (610), and a storage (690) for storing the computer program (691). However, only components related to an embodiment of the present disclosure are illustrated in FIG. 6.

[0137] Therefore, a person skilled in the art to which this disclosure belongs will understand that other general-purpose components may be included in addition to the components shown in FIG. 6.

[0138] The processor (610) controls the overall operation of each component of the computing device (600). The processor (610) may be configured to include a CPU (Central Processing Unit), an MPU (Micro Processor Unit), an MCU (Micro Controller Unit), a GPU (Graphic Processing Unit), or any form of processor (610) well known in the art of the present disclosure. Additionally, the processor (610) may perform operations for at least one application or program for executing the method according to the embodiments of the present disclosure. The computing device (600) may have one or more processors (610). The computing device (600) may refer to artificial intelligence (AI).

[0139] The memory (630) stores various data, commands and / or information. The memory (630) may load one or more programs (691) from storage (690) to execute a method according to embodiments of the present disclosure. The memory (630) may be implemented as a volatile memory such as RAM, but the technical scope of the present disclosure is not limited thereto.

[0140] The bus (650) provides communication functions between components of the computing device (600). The bus (650) can be implemented as various types of buses, such as an address bus, a data bus, and a control bus.

[0141] The communication interface (670) supports wired and wireless internet communication of the computing device (600). Additionally, the communication interface (670) may support various communication methods other than internet communication. To this end, the communication interface (670) may be configured to include a communication module well known in the art of the present disclosure.

[0142] According to some embodiments, the communication interface (670) may be omitted.

[0143] Storage (690) can store one or more programs (691) and various data non-temporarily.

[0144] Storage (690) may be configured to include non-volatile memory such as ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), flash memory, a hard disk, a removable disk, or any form of computer-readable storage medium well known in the art to which this disclosure belongs.

[0145] The computer program (691) may include one or more instructions that cause the processor (610) to perform a method / operation according to various embodiments of the present disclosure when loaded into memory (630). That is, the processor (610) may perform a method / operation according to various embodiments of the present disclosure by executing one or more instructions.

[0146]

[0147] Although preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above. Various modifications are possible by those skilled in the art without departing from the essence of the invention as claimed in the patent claims, and such modifications should not be understood individually from the technical spirit or perspective of the present invention.

Claims

1. By an obfuscation unit that executes multiple obfuscation processes of different types in combination, A first obfuscation step of reconstructing source code into multiple executable basic blocks; A second obfuscation step of inserting at least one fake base block between the above executable base blocks; and A third obfuscation step of inserting junk code into each of the above-mentioned executable base block and the above-mentioned fake base block; comprising, A multi-code conversion method for binary obfuscation, wherein the executable basic block comprises at least one switch-case statement expressing at least some statements of the source code.

2. In Paragraph 1, An IR generation step for generating an obfuscated intermediate language (IR: Intermediate Representation) using the executable base block with the aforementioned junk code inserted and the aforementioned fake base block; and A multi-code conversion method for binary obfuscation, further comprising a binary code generation step of generating the obfuscated binary code from the obfuscated IR.

3. In Paragraph 1, The above first obfuscation step is, A dispatcher block generation step for generating a dispatcher block that controls the execution flow of the above-mentioned executable basic blocks; and A multi-code conversion method for binary obfuscation, comprising: a control flow flattening step for reconstructing the executable base blocks into a flattened structure by mapping each of the executable base blocks to the dispatcher block.

4. In Paragraph 3, The above second obfuscation step is, A multi-code conversion method for binary obfuscation, comprising a Fake Basic Block Insertion step of inserting the Fake Basic Block so that the Fake Basic Block is mapped to the Dispatcher Block and the executable Basic Blocks of the flattened structure are connected in parallel with respect to the Dispatcher Block.

5. In Paragraph 1, The above third obfuscation step is, A multi-code conversion method for binary obfuscation, comprising a junk code insertion step of randomly inserting at least one instruction that performs Add, Sub, Mul, Div, Xor, Not, and Or operations as the junk code into each of the executable base block and the fake base block.

6. Includes an obfuscation unit that combines and executes multiple obfuscation processes of different types, The above obfuscation part is, A control flow flattening unit that reconstructs source code into multiple executable basic blocks; A fake base block insertion unit that inserts at least one fake base block between the above-mentioned executable base blocks; and A junk code insertion unit that inserts junk code into each of the above-mentioned executable base block and the above-mentioned fake base block; comprising A multi-code conversion device for binary obfuscation, wherein the executable basic block comprises at least one switch-case statement expressing at least some statements of the source code.

7. In Paragraph 6, An IR generation unit that generates an obfuscated Intermediate Representation (IR) using the executable base block with the aforementioned junk code inserted and the aforementioned fake base block; and A multi-code conversion device for binary obfuscation, further comprising a binary code generation unit that generates the obfuscated binary code from the obfuscated IR.

8. In Paragraph 6, The above control flow flattening unit is, A dispatcher block generating unit that generates a dispatcher block controlling the execution flow of the above-mentioned executable basic blocks; comprising A multi-code conversion device for binary obfuscation that reconstructs the executable base blocks into a flattened structure by mapping each of the executable base blocks to the dispatcher block.

9. In Paragraph 8, The above fake basic block insertion part is, A multi-code conversion device for binary obfuscation that maps the fake base block to the dispatcher block and inserts the fake base block so that the fake base block and the executable base blocks of the flattened structure are connected in parallel with respect to the dispatcher block.

10. In Paragraph 6, The above junk code insertion part is, A multi-code conversion device for binary obfuscation that randomly inserts at least one instruction performing Add, Sub, Mul, Div, Xor, Not, and Or operations as the junk code into each of the above-mentioned executable base block and the above-mentioned fake base block.

Images