MBA Opaque Predicates Using Multiplication Against Symbolic Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current obfuscation techniques using opaque predicates are not sufficiently effective against deobfuscation attacks based on symbolic execution, particularly due to the efficiency of SMT-solvers in solving mixed Boolean-arithmetic expressions.
Innovation Solution
The method involves generating opaque predicates through multiplication operations using mixed Boolean-arithmetic expressions, which are harder for SMT-solvers to solve, by creating conditional branch instructions that evaluate equality or inequality of terms and branch accordingly, and splitting basic blocks of instructions to enhance obfuscation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional opaque predicates based on simple mixed Boolean-arithmetic expressions are used, then the obfuscation implementation is simple, but the obfuscation effectiveness against symbolic execution attacks is insufficient
Solution Approach 1:
The patent combines multiple MBA expressions through multiplication operations to create composite opaque predicates. Instead of using single MBA expressions, the invention multiplies two or more MBA expressions together, creating a composite structure that maintains mathematical equivalence (always true or always false) while significantly increasing complexity for symbolic execution solvers.
2Reliability
If multiplication operations with mixed Boolean-arithmetic expressions are used to generate opaque predicates, then the resistance to symbolic execution attacks is significantly improved, but the computational complexity of the obfuscation increases
Solution Approach 1:
The patent changes the parameters of the MBA expressions by performing multiplication operations on them. By multiplying MBA expressions with different coefficients and variable combinations, the invention transforms simple equality checks into complex multiplicative relationships that maintain the same logical outcome (always true/false) but require significantly more computational effort for symbolic execution.
Data Source
AI summary
Provided is a program and computer-implemented method of obfuscating a software code, comprising adding a conditional branch instruction to the software code which, when executed, causes evaluating an opaque predicate (PT, PF, P?). The method comprises a step of generating the opaque predicate which includes performing a multiplication operation having as operands two mixed Boolean-arithmetic expressions. Other embodiments disclosed.