基于Capstone和流敏感混合执行的自动化反混淆技术
作者:
作者单位:

1.广州大学;2.东北大学

基金项目:

国家自然科学基金(61972108, U20B2046)


Automated anti-obfuscation technology based on Capstone and flow-sensitive concolic execution
  • 摘要
  • | |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • | |
  • 文章评论
    摘要:

    经过多年的技术发展和攻防对抗, Android平台应用加固技术已经相当成熟,防护粒度从DEX代码抽取逐步发展成为将核心功能代码写入共享链接文件,再对此Native层文件加入OLLVM混淆等技术,将防护面从Java层下沉到Native层,由通用的DEX动态修改进化为高度定制化的Native层混淆机制,以求不断增加逆向分析的难度和工作量来增强保护客户端的代码. 针对近期崛起的OLLVM混淆加固技术,本文提出基于Capstone和流敏感混合执行的自动化反混淆决方案(CiANa). 采用Capstone引擎分析基本块及其指令结构实现游离在程序反汇编控制流程图中各处的真实块的识别,然后基于流敏感的混合执行确定各真实块间的执行顺序,最后对真实块汇编指令进行指令修复得到反混淆后的可执行二进制文件. 对比实验结果表明, CiANa可恢复ARM/ARM64架构下OLLVM混淆过后的Android Native文件. CiANa是目前为止第一个在ARM/ARM64架构中能对全版本(Debug/Realse版本)的OLLVM进行有效反混淆的框架,为逆向分析提供了必要的辅助支撑功能.

    Abstract:

    After years of technical development and attack defense confrontation, the Android platform application reinforcement technology has been quite mature. The protection granularity has gradually developed from DEX code extraction to writing the core function code into the shared link file, and then adding technology such as ollvm obfuscation to the native layer file, sinking the protection surface from Java layer to native layer, In order to increase the difficulty and workload of reverse analysis and protect the client's code, the dynamic modification of general DEX has evolved into a highly customized native layer obfuscation mechanism, In this paper, an automatic anti obfuscation solution (ciana) based on the mixed execution of Capstone and flow sensitive is proposed. The capstone engine is used to analyze the basic block and its instruction structure to realize the identification of real blocks in the control flow chart of program disassembly. Then, the execution sequence of real blocks is determined based on the mixed execution of flow sensitive, Finally, the real block assembly instructions are repaired to get the anti obfuscated executable binary files. The comparative experimental results show that ciana can recover the Android native files after ollvm obfuscation in arm / arm64 architecture. Ciana is the first effective anti obfuscation framework for full version (debug / realse version) of ollvm in arm / arm64 architecture, It provides necessary auxiliary support function for reverse analysis.

    参考文献
    相似文献
    引证文献
引用本文
相关视频

分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2021-06-23
  • 最后修改日期:2022-01-10
  • 录用日期:2022-02-15
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62562563 传真:010-62562533 Email:jos@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号