| 摘要: |
| 控制流是程序过程的抽象表现, 对控制流进行混淆, 可有效提高代码抗逆向能力. 提出了控制流深度模糊思想:针对循环结构, 利用回调函数构造等价循环模型, 将过程内基本块跳转变更为过程间函数调用, 对抗逆向技术. 综合应用控制流分析和数据流依赖性分析, 建立了基于回调函数的控制流深度模糊模型, 并给出功能一致性证明. 为进一步增大混淆强度, 设计并实现了函数调用融合算法, 构造更为复杂的函数调用过程. 最后, 使用OpenSSL和SpecInt-2000标准测试套件作为测试集, 验证了模型的可行性和有效性. |
| 关键词: 深度模糊 回调函数 循环结构 数据流依赖 代码变换 |
| DOI：10.13328/j.cnki.jos.006197 |
| 分类号:TP311 |
| 基金项目:国家重点研发计划(2016YFB08011601) |
|
| Deep Control Flow Obfuscation Model Based on Callback Function |
|
SHA Zi-Han1, SHU Hui1, WU Cheng-Gang2, XIONG Xiao-Bing1, KANG Fei1
|
|
1.State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China;2.Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China
|
| Abstract: |
| Control flow is an abstract expression of the program process, and it is of critical significance to obfuscate the control flow to effectively reinforce the code’s ability to resist reverse manners. This study proposes the idea of deep control flow: as for the loop structure, the callback function is utilized to construct an equivalent loop model, and the basic block in the program process is converted into inter-process function calling to counter reverse technology. This study comprehensively applies control flow analysis and data flow dependency analysis to establish a deep control flow obfuscation model based on callback function and gives proof of functional consistency. To further enhance obfuscation, the function calling fusion algorithm is designed and implemented pertinently to construct a more sophisticated function calling process. Finally, OpenSSL and SPECint-2000 benchmark suite is used as the test set to verify the feasibility and effectiveness of the proposed model. |
| Key words: deep control flow callback function loop structure data flow dependency code transformation |
