| Software will leak path information at runtime. In recent years, concolicexecution, dynamic taint analysis and theorem proving are widely used in softwarereverse engineering, that attackers can collect path constraints from software’s binaryexecution trace and reason about software internal logic, posing a serious threat tosoftware intellectual property protection.This article analyzed the software’s path information leakage problem, andproposed path obfuscation technique, which used unsolved conjectures, instruction’sside effects and prefix-preserving algorithm to protect software’s path informationwithout changing software’s functionality. The research results are as follows:1. Path obfuscation using unsolved mathematical conjectures. The Collatzconjecture also known as the3x+1problem has not been proved, but in the checkedinteger range, there is no counter-example, and the checked range is much larger thansoftware’s commonly used integer range. Therefore, the Collatz conjecture andsimilar unsolved mathematical conjectures can be used to obfuscate software’s pathinformation, without changing software’s functionality，and the difficulty of reverseengineering using leaked path information will be equivalent to the difficulty ofproving these unresolved mathematical conjectures. Path obfuscation using unsolvedmathematical conjectures is a linear obfuscation, and the experiments show that theadded space and time cost is very small, and the obfuscated codes resemble theoriginal code.2. Path obfuscation using side effects of CPU instruction. Conditional jumpinstructions disclose software’s path information in the execution trace. In order toprevent path information leakage, this work uses conditional exception codes toreplace the conditional jump instructions, that the branch information is hid in theimplicit instruction’s side effects, and uses OS exception handling mechanism tocarry out control transfer. Most instructions in the x86complex instruction set haveimplicit side effects, and there are a variety of context which can affect instruction’s execution. Therefore, the difficulty of collecting software’s path information fromexecution trace is equivalent to the difficulty of reasoning about the possible sideeffects of all CPU instructions in a variety of execution environments, and the reverseengineering’s efficiency is similar to random guessing. The experimental results showthat this obfuscation strategy can effectively hide the software’s path information, andhas an excellent obfuscation strength and resilience.3. Path obfuscation using one-way prefix-preserving algorithm. Hash functionshave good one-way property, so it is difficult for attackers to calculate the input fromhash value, but the hash function is not order-preserving, that its application range islimited to the protection of equal conditions. This work extends one-way hashfunction’s application by introducing prefix-preserving algorithm. Becauseprefix-preserving algorithm could convert a data range to a prefix set, an unequalcondition could be changed to equal conditions based on prefix matching. Therefore,prefix-preserving algorithm increased the application of one-way hash function in thesoftware protection. The difficulty of reverse engineering using leaked pathinformation is equivalent to the difficulty of calculating hash function’s inputaccording to the hash value.4. Design and implementation of path obfuscation system. This work analyzedthe application range, strength, resilience, cost and stealth of different pathobfuscation strategies, and proposed an optimized obfuscation strategy. After that,this work designed and implemented an automated path obfuscation system to reducethe workload of programmers, which is based on the open source LLVM compilerinfrastructure. The results show that this path obfuscation system can effectivelyprotect software’s path information, and the increased overhead in the time and spaceis limited. |
