Binary obfuscation using signals

16th USENIX Security Symposium

Volumn , Issue , 2007, Pages 275-290

  Popov, Igor V ^a   Debray, Saumya K ^a   Andrews, Gregory R ^a  

^a University of Arizona   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BINARY PROGRAMS; CONTROL FLOWS; DISASSEMBLERS; LEVEL STRUCTURE; MACHINE CODES; PROGRAM REPRESENTATIONS; SECURITY VULNERABILITIES; SOURCE CODES;

REVERSE ENGINEERING;

EID: 85045981068     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (33)

1. D. Aucsmith. Tamper-resistant software: An implementation. In Information Hiding: First International Workshop: Proceedings, volume 1174 of Lecture Notes in Computer Science, pages 317–333. Springer-Verlag, 1996.
2. Black Fenix. Black fenix’s anti-debugging tricks. http://in.fortunecity.com/skyscraper/browser/12/sicedete.html.
3. S. Cesare. Linux anti-debugging techniques (fooling the debugger), January 1999. VX Heavens. http://vx.netlux.org/lib/vsc04.html.
4. M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant. Semantics-aware malware detection. In Proc. 2005 IEEE Symposium on Security and Privacy (Oakland 2005), pages 32–46, May 2005.
5. C. Cifuentes. Reverse Compilation Techniques. PhD thesis, Queensland University of Technology, Australia, July 1994.
6. C. Cifuentes and K. J. Gough. Decompilation of binary programs. Software—Practice and Experience, 25(7):811–829, July 1995.
7. F. B. Cohen. Operating system protection through program evolution, 1992. http://all.net/books/IP/evolve.html.
8. R. S. Cohn, D. W. Goodwin, and P. G. Lowney. Optimizing Alpha executables on Windows NT with Spike. Digital Technical Journal, 9(4):3–20, 1997.
9. C. Collberg and C. Thomborson. Watermarking, tamper-proofing, and obfuscation – tools for software protection. IEEE Transactions on Software Engineering, 28(8), August 2002.
10. C. Collberg, C. Thomborson, and D. Low. Breaking abstractions and unstructuring data structures. In Proc. 1998 IEEE International Conference on Computer Languages, pages 28–38.
11. DataRescue sa/nv, Liége, Belgium. IDA Pro. http://www.datarescue.com/idabase/.
12. M. L. Fredman, J. Komlós, and E. Szemerédi. Storing a sparse table with O(1) worst case access time. Journal of the ACM, 31(3):538–544, July 1984.
13. C. R. Hollander. Decompilation of object programs. PhD thesis, Stanford University, 1973.
14. A. Kapoor. An approach towards disassembly of malicious binaries. Master’s thesis, University of Louisiana at Lafayette, 2004.
15. C. Kruegel, W. Robertson, F. Valeur, and G. Vigna. Static disassembly of obfuscated binaries. In Proc. 13th USENIX Security Symposium, August 2004.
16. C. Krügel, E. Kirda, D. Mutz, W. Robertson, and G. Vigna. Polymorphic worm detection using structural information of executables. In Recent Advances in Intrusion Detection, volume 3858 of Lecture Notes in Computer Science, pages 207–226. Springer, 2005.
17. E. U. Kumar, A. Kapoor, and A. Lakhotia. DOC – answering the hidden ‘call’ of a virus. Virus Bulletin, April 2005.
18. A. Lakhotia, E. U. Kumar, and M. Venable. A method for detecting obfuscated calls in malicious binaries. IEEE Transactions on Software Engineering, 31(11):955–968, 2005.
19. D. Lie, C. Thekkath, M. Mitchell, P. Lincoln, D. Boneh, J. Mitchell, and M. Horowitz. Architectural support for copy and tamper resistant software. In Proc. 9th. International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS-IX), pages 168–177, November 2000.
20. C. Linn and S.K. Debray. Obfuscation of executable code to improve resistance to static disassembly. In Proc. 10th. ACM Conference on Computer and Communications Security (CCS 2003), pages 290–299, October 2003.
21. C. M. Linn, M. Rajagopalan, S. Baker, C. Collberg, S. K. Debray, and J. H. Hartman. Protecting against unexpected system calls. In Proc. Usenix Security ’05, pages 239–254, August 2005.
22. R. Muth and S. K. Debray. On the complexity of flow-sensitive dataflow analyses. In Proc. 27th ACM Symposium on Principles of Programming Languages (POPL-00), pages 67–80, January 2000.
23. R. Muth, S. K. Debray, S. Watterson, and K. De Bosschere. alto: A link-time optimizer for the Compaq Alpha. Software—Practice and Experience, 31:67–101, January 2001.
24. Objdump. GNU Manuals Online. GNU Project—Free Software Foundation. www.gnu.org/manual/binutils-2.10.1/html_chapter/binutils_4.html.
25. M. Prasad and T. Chiueh. A binary rewriting defense against stack based buffer overflow attacks. In Proc. USENIX Technical Conference, June 2003.
26. B. Schwarz, S. K. Debray, and G. R. Andrews. Disassembly of executable code revisited. In Proc. IEEE 2002 Working Conference on Reverse Engineering (WCRE), pages 45–54, October 2002.
27. P. K. Singh, M. Mohammed, and A. Lakhotia. Using static analysis and verification for analyzing virus and worm programs. In Proc. 2nd. European Conference on Information Warfare, June 2003.
28. R. L. Sites, A. Chernoff, M. B. Kirk, M. P. Marks, and S. G. Robinson. Binary translation. Communications of the ACM, 36(2):69–81, February 1993.
29. A. Srivastava and D. W. Wall. A practical system for intermodule code optimization at link-time. Journal of Programming Languages, 1(1):1–18, March 1993.
30. H. Theiling. Extracting safe and precise control flow from binaries. In Proc. 7th Conference on Real-Time Computing Systems and Applications, December 2000.
31. C. Wang, J. Davidson, J. Hill, and J. Knight. Protection of software-based survivability mechanisms. In Proc. International Conference of Dependable Systems and Networks, July 2001.
32. C. Wang, J. Hill, J. Knight, and J. Davidson. Software tamper resistance: Obstructing static analysis of programs. Technical Report CS-2000-12, Dept. of Computer Science, University of Virginia, 12 2000.
33. Z. Xu, B. P. Miller, and T. Reps. Safety checking of machine code. In Proc. ACM SIGPLAN’00 Conference on Programming Language Design and Implementation, pages 70–82, June 18–21, 2000.