Sciweavers

Share
ESORICS
2011
Springer

Linear Obfuscation to Combat Symbolic Execution

7 years 6 months ago
Linear Obfuscation to Combat Symbolic Execution
Abstract. Trigger-based code (malicious in many cases, but not necessarily) only executes when specific inputs are received. Symbolic execution has been one of the most powerful techniques in discovering such malicious code and analyzing the trigger condition. We propose a novel automatic malware obfuscation technique to make analysis based on symbolic execution difficult. Unlike previously proposed techniques, the obfuscated code from our tool does not use any cryptographic operations and makes use of only linear operations which symbolic execution is believed to be good in analyzing. The obfuscated code incorporates unsolved conjectures and adds a simple loop to the original code, making it less than one hundred bytes longer and hard to be differentiated from normal programs. Evaluation shows that applying symbolic execution to the obfuscated code is inefficient in finding the trigger condition. We discuss strengths and weaknesses of the proposed technique.
Zhi Wang, Jiang Ming, Chunfu Jia, Debin Gao
Added 20 Dec 2011
Updated 20 Dec 2011
Type Journal
Year 2011
Where ESORICS
Authors Zhi Wang, Jiang Ming, Chunfu Jia, Debin Gao
Comments (0)
books