Defeating MBA-based Obfuscation
Authors:
Open Access
- 28 October 2016
- conference paper
- Published by Association for Computing Machinery (ACM)
- p. 27-38
Abstract
International audienceMixed Boolean-Arithmetic expressions are presented as a strong protection in the context of data flow obfuscation. As there is very little literature on the analysis of such obfus-cated expressions, two important subjects of interest are: to define what simplifying those expressions means, and how to design a simplification solution. We focus on evaluating the resilience of this technique, by giving theoretical elements to justify its efficiency and proposing a simplification algorithm using a pattern matching approach. The implementation of this solution is capable of simplifying the public examples of MBA-obfuscated expressions, demonstrating that at least a subset of MBA obfuscation lacks resilience against pattern matching analysisKeywords
This publication has 11 references indexed in Scilit:
- Capturing the Essence of Practical Obfuscation2012
- Rotational Cryptanalysis of ARX2010
- A System for Generating Static Analyzers for Machine Instructions2008
- Z3: An Efficient SMT Solver2008
- Information Hiding in Software with Mixed Boolean-Arithmetic Transforms2007
- A New Class of Invertible Mappings2003
- Digital Algebra and Circuits2003
- Watermarking, tamper-proofing, and obfuscation - tools for software protectionIEEE Transactions on Software Engineering, 2002
- A Proposal for a New Block Encryption Standard1991
- Algebraic Simplification1982