Software obfuscation is a crucial technology to protect intellectual property and manage digital rights within our society. Despite its huge practical importance, both commercial and academic state-of-the-art obfuscation methods are vulnera-ble to a plethora of automated deobfuscation attacks, such as symbolic execution, taint analysis, or program synthesis. While several enhanced obfuscation techniques were recently proposed to thwart taint analysis or symbolic execution, they either impose a prohibitive runtime overhead or can be removed in an automated way (e. g., via compiler optimizations). In general, these techniques suffer from focusing on a single attack vector, allowing an attacker to switch to other, more effective techniques, such as program synthesis. In this work, we present L OKI , an approach for software obfuscation that is resilient against all known automated deobfuscation attacks. To this end, we use and efficiently combine multiple techniques, including a generic approach to synthesize formally verified expressions of arbitrary complexity. Contrary to state-of-the-art approaches that rely on a few hardcoded generation rules, our expressions are more diverse and harder to pattern match against. We show that even the state-of-the-art approach on Mixed-Boolean Arithmetic (MBA) deobfuscation fails to simplify them. Moreover, L OKI protects against previously unaccounted attack vectors such as program synthesis, for which it reduces the success rate to merely 19%. In a comprehensive evaluation, we show that our design incurs significantly less overhead while providing a much stronger protection level compared to existing works.

Loki: Hardening Code Obfuscation Against Automated Attacks

L'obfuscation de logiciels est une technique de protection deprogrammes qui transforme du code pour rendre son analyse plusdifficile. Les expressions mixtes arithmetico-booleennes (MBA) sontpresentees comme une bonne obfuscation du flot de donnees. Le domainede l'obfuscation MBA etant assez jeune, il beneficie de peu delitterature sur la conception et l'analyse de telles expressionsobfusquees. Ainsi, beaucoup de sujets interessants apparaissent lors deson etude, autant sur l'obfuscation que sur la desobfuscation (ousimplification) d'expressions MBA.Durant nos recherches, nous avons structure le sujet de l'obfuscationMBA, le reliant a d'autres domaines comme la cryptographie ou lareecriture. Nous avons egalement reconstruit une techniqued'obfuscation MBA a partir d'echantillons publics. Nous avons etudie ce quesignifie simplifier une expression obfusquee, et defininos propres metriques de simplicite pour les expressions MBA. L'etudede la simplification MBA a entraine l'implementation de deux outils dedesobfuscation, qui ont simplifie avec succes plusieurs examplespublics d'expressions obfusquees. Finalement, nous avons evalue laresilience de l'obfuscation MBA par rapport a nos algorithmes desimplification (ainsi que d'autres techniques de desobfuscation), etnous avons conclu que la technique d'obfuscation MBA offrait peu deresilience en l'etat. Nous avons donc propose quelques pistes pourameliorer ce type d'obfuscation.

Obfuscation par expressions mixtes arithmético-booléennes : reconstruction, analyse et outils de simplification

Mixed Boolean-Arithmetic (MBA) expression mixes bitwise operations (e.g., AND, OR, and NOT) and arithmetic operations (e.g., ADD and IMUL). It enables a semantic-preserving program transformation to convert a simple expression to a difficult-to-understand but equivalent form. MBA expression has been widely adopted as a highly effective and low-cost obfuscation scheme. However, state-of-the-art deobfuscation research proposes substantial challenges to the MBA obfuscation technique. Attacking methods such as bit-blasting, pattern matching, program synthesis, deep learning, and mathematical transformation can successfully simplify specific categories of MBA expressions. Existing MBA obfuscation must be enhanced to overcome these emerging challenges.

Software Obfuscation with Non-Linear Mixed Boolean-Arithmetic Expressions.

Mixed Boolean-Arithmetic (MBA) expressions are frequently used for obfuscation. As they combine arithmetic as well as Boolean operations, neither arithmetic laws nor transformation rules for logical formulas can be applied to suitably complex expressions, making MBAs hard to simplify and solve. In 2019, Liu et al. demystified linear MBAs, leveraging a transformation between the set B={0, 1} of bit values and the set Bn of words of length n∊N for linear MBAs, originally introduced by Zhou et al. in 2007. With their MBA-Blast and MBA-Solver algorithms, they outperform existing tools noticably in terms of performance as well as ability to simplify of such MBAs. We propose a surprisingly simple algorithm called SiMBA that improves upon MBA-Blast and MBA-Solver in that it can deobfuscate all linear MBAs, does not miss particularly simple solutions and takes only a fraction of their runtime.

/pdf/efficient-deobfuscation-of-linear-mixed-boolean-arithmetic-1nagzr32.pdf

Efficient Deobfuscation of Linear Mixed Boolean-Arithmetic Expressions

Data constraints are widely used in FinTech systems for monitoring data consistency and diagnosing anomalous data manipulations. However, many equivalent data constraints are created redundantly during the development cycle, slowing down the FinTech systems and causing unnecessary alerts. We present EQDAC, an efficient decision procedure to determine the data constraint equivalence. We first propose the symbolic representation for semantic encoding and then introduce two light-weighted analyses to refute and prove the equivalence, respectively, which are proved to achieve in polynomial time. We evaluate EQDAC upon 30,801 data constraints in a FinTech system. It is shown that EQDAC detects 11,538 equivalent data constraints in three hours. It also supports efficient equivalence searching with an average time cost of 1.22 seconds, enabling the system to check new data constraints upon submission.

Verifying Data Constraint Equivalence in FinTech Systems

Satisfiability Modulo Theories (SMT) solvers have been widely applied in automated software analysis to reason about the queries that encode the essence of program semantics, relieving the heavy burden of manual analysis. Many SMT solving techniques rely on solving Boolean satisfiability problem (SAT), which is an NP-complete problem, so they use heuristic search strategies to seek possible solutions, especially when no known theorem can efficiently reduce the problem. An emerging challenge, named Mixed-Bitwise-Arithmetic (MBA) obfuscation, impedes SMT solving by constructing identity equations with both bitwise operations (and, or, negate) and arithmetic computation (add, minus, multiply). Common math theorems for bitwise or arithmetic computation are inapplicable to simplifying MBA equations, leading to performance bottlenecks in SMT solving. In this paper, we first scrutinize solvers' performance on solving different categories of MBA expressions: linear, polynomial, and non-polynomial. We observe that solvers can handle simple linear MBA expressions, but facing a severe performance slowdown when solving complex linear and non-linear MBA expressions. The root cause is that complex MBA expressions break the reduction laws for pure arithmetic or bitwise computation. To boost solvers' performance, we propose a semantic-preserving transformation to reduce the mixing degree of bitwise and arithmetic operations. We first calculate a signature vector based on the truth table extracted from an MBA expression, which captures the complete MBA semantics. Next, we generate a simpler MBA expression from the signature vector. Our large-scale evaluation on 3000 complex MBA equations shows that our technique significantly boost modern SMT solvers' performance on solving MBA formulas.

Boosting SMT solver performance on mixed-bitwise-arithmetic expressions

Mixed Boolean-Arithmetic (MBA) expressions involve both arithmetic calculation (e.g.,plus, minus, multiply) and bitwise computation (e.g., and, or, negate, xor). MBA expressions have been widely applied in software obfuscation, transforming programs from a simple form to a complex form. MBA expressions are challenging to be simplified, because the interleaving bitwise and arithmetic operations causing mathematical reduction laws to be ineffective. Our goal is to recover the original, simple form from an obfuscated MBA expression. In this paper, we first propose NeuReduce, a string to string method based on neural networks to automatically learn and reduce complex MBA expressions. We develop a comprehensive MBA dataset, including one million diversified MBA expression samples and corresponding simplified forms. After training on the dataset, NeuReduce can reduce MBA rules to homelier but mathematically equivalent forms. By comparing with three state-of-the-art MBA reduction methods, our evaluation result shows that NeuReduce outperforms all other tools in terms of accuracy, solving time, and performance overhead.

/pdf/neureduce-reducing-mixed-boolean-arithmetic-expressions-by-32ahrzn7wg.pdf

NeuReduce: Reducing Mixed Boolean-Arithmetic Expressions by Recurrent Neural Network.

/pdf/mba-blast-unveiling-and-simplifying-mixed-boolean-arithmetic-3gpwd2uqbe.pdf

MBA-Blast: Unveiling and Simplifying Mixed Boolean-Arithmetic Obfuscation

Mixed Boolean-arithmetic (MBA) expression, which involves both bitwise operations (e.g., NOT, AND, and OR) and arithmetic operations (e.g., 
 
 +
 
 , 
 
 −
 
 , and 
 
 ∗
 
 ), is a software obfuscation scheme. On the other side, multiple methods have been proposed to simplify MBA expressions. Among them, table-based solutions are the most powerful simplification research. However, a fundamental limitation of the table-based solutions is that the space complexity of the transformation table drastically explodes with the number of variables in the MBA expression. In this study, we propose a novel method to simplify MBA expressions without any precomputed requirements. First, a bitwise expression can be transformed into a unified form, and we provide a mathematical proof to guarantee the correctness of this transformation. Then, the arithmetic reduction is smoothly performed to further simplify the expression and produce a concise result. We implement the proposed scheme as an open-source tool, named MBA-Flatten, and evaluate it on two comprehensive benchmarks. The evaluation results show that MBA-Flatten is a general and effective MBA simplification method. Furthermore, MBA-Flatten can assist malware analysis and boost SMT solvers’ performance on solving MBA equations.

/pdf/an-in-place-simplification-on-mixed-boolean-arithmetic-3canybvd.pdf

Binbin Liu

Papers

Boosting SMT solver performance on mixed-bitwise-arithmetic expressions

NeuReduce: Reducing Mixed Boolean-Arithmetic Expressions by Recurrent Neural Network.

Software Obfuscation with Non-Linear Mixed Boolean-Arithmetic Expressions.

MBA-Blast: Unveiling and Simplifying Mixed Boolean-Arithmetic Obfuscation

An In-Place Simplification on Mixed Boolean-Arithmetic Expressions