网络与信息安全学报 (Oct 2023)
Constructing method of opaque predicate based on type conversion and operation of floating point numbers
Abstract
With the increasing complexity of software functions and the evolving technologies of network attacks, malicious behaviors such as software piracy, software cracking, data leakage, and malicious software modification are on the rise.As a result, software security has become a focal point in industry research.Code obfuscation is a common software protection technique used to hinder reverse engineering.It aims to make program analyzing and understanding more difficult for attackers while preserving the original program functionality.However, many existing code obfuscation techniques suffer from performance loss and poor concealment in pursuit of obfuscation effectiveness.Control flow obfuscation, particularly opaque predicate obfuscation, is widely used to increase the difficulty of code reverse engineering by disrupting the program’s control flow.A method was proposed to address the limitations of existing code obfuscation techniques.It utilized the phenomenon of precision loss that occurred during type conversion and floating-point number operations in computers.Under certain conditions, this method produced operation results that contradict common sense.By performing forced type conversion, addition, and multiplication with selected decimal numbers, a series of opaque predicates can be constructed based on the statistical analysis of their operation results.This approach achieved code obfuscation with high concealment, good generality, reversibility, and low overhead compared to traditional opaque predicates.Experimental verification demonstrates that this method significantly slows down attackers’ reverse engineering efforts and exhibits good resistance to dynamic analysis techniques such as symbolic execution.
