Search-based local black-box deobfuscation: understand, improve and mitigate - CEA - Commissariat à l’énergie atomique et aux énergies alternatives Access content directly
Conference Papers Year : 2021

Search-based local black-box deobfuscation: understand, improve and mitigate

Abstract

Code obfuscation aims at protecting Intellectual Property and other secrets embedded into software from being retrieved. Recent works leverage advances in artificial intelligence (AI) with the hope of getting blackbox deobfuscators completely immune to standard (whitebox) protection mechanisms. While promising, this new field of AI-based, and more specifically search-based blackbox deobfuscation, is still in its infancy. In this article we deepen the state of search-based blackbox deobfuscation in three key directions: understand the current state-of-the-art, improve over it and design dedicated protection mechanisms. In particular, we define a novel generic framework for search-based blackbox deobfuscation encompassing prior work and highlighting key components; we are the first to point out that the search space underlying code deobfuscation is too unstable for simulation-based methods (e.g., Monte Carlo Tree Search used in prior work) and advocate the use of robust methods such as S-metaheuristics; we propose the new optimized search-based blackbox deobfuscator Xyntia which significantly outperforms prior work in terms of success rate (especially with small time budget) while being completely immune to the most recent anti-analysis code obfuscation methods; and finally we propose two novel protections against search-based blackbox deobfuscation, allowing to counter Xyntia powerful attacks.
Fichier principal
Vignette du fichier
2021-ccs.pdf (912.08 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

cea-04258913 , version 1 (25-10-2023)

Identifiers

Cite

Grégoire Menguy, Sébastien Bardin, Richard Bonichon, Cauim de Souza Lima. Search-based local black-box deobfuscation: understand, improve and mitigate. CCS '21: 2021 ACM SIGSAC Conference on Computer, Nov 2021, Virtual Event (Republic of Korea), South Korea. pp.2513-2525, ⟨10.1145/3460120.3485250⟩. ⟨cea-04258913⟩
18 View
7 Download

Altmetric

Share

Gmail Mastodon Facebook X LinkedIn More