Software obfuscation is a crucial technology to protect intellectual property and manage digital rights within our society. Despite its huge practical importance, both commercial and academic state-of-the-art obfuscation methods are vulnerable to a plethora of automated deobfuscation attacks, such as symbolic execution, taint analysis, or program synthesis. While several enhanced obfuscation techniques were recently proposed to thwart taint analysis or symbolic execution, they either impose a prohibitive runtime overhead or can be removed in an automated way (e.g., via compiler optimizations). In general, these techniques suffer from focusing on a single attack vector, allowing an attacker to switch to other, more effective techniques, such as program synthesis. In this work, we present Loki, an approach for software obfuscation that is resilient against all known automated deobfuscation attacks. To this end, we use and efficiently combine multiple techniques, including a generic approach to synthesize formally verified expressions of arbitrary complexity. Contrary to state-of-the-art approaches that rely on a few hardcoded generation rules, our expressions are more diverse and harder to pattern match against. Even the most recent state-of-the-art research on Mixed-Boolean Arithmetic (MBA) deobfuscation fails to simplify them. Moreover, Loki protects against previously unaccounted attack vectors such as program synthesis, for which it reduces the success rate to merely 19%. In a comprehensive evaluation, we show that our design incurs significantly less overhead while providing a much stronger protection level compared to existing works.
翻译:尽管这些技术具有巨大的实际重要性,但商业和学术上最先进的混淆方法都容易受到大量自动脱钩攻击,例如象征性执行、污点分析或程序合成。虽然最近提出了几种强化的混淆技术,以挫败污染分析或象征性执行,但它们要么是高压运行时间管理,要么可以自动清除(例如,通过编译器优化)。一般而言,这些技术因专注于单一攻击矢量而受到影响,使得一个攻击者能够转换到其他更有效的技术,例如程序合成等。在此工作中,我们向Loki介绍一种软件迷雾处理方法,这种方法能够抵御所有已知的自动脱钩攻击或象征性执行。为此,我们使用并有效地结合多种技术,包括一种经正式核实的任意复杂性表达方式(例如,通过编译器优化),与最先进的方法相反,这种方法提供了依赖少数硬编码的向导矢量的矢量,使一个更全面攻击者能够转换到其他更有效的技术,例如程序合成。我们用最多样化和更难的版本设计程序来降低我们目前的成本,从而大大地降低目前的尾压。