TY - GEN
T1 - ROPOB
T2 - 13th EAI International Conference on Security and Privacy in Communication Networks, SecureComm 2017
AU - Mu, Dongliang
AU - Guo, Jia
AU - Ding, Wenbiao
AU - Wang, Zhilong
AU - Mao, Bing
AU - Shi, Lei
N1 - Funding Information:
We thank the anonymous reviewers for their helpful feedback. This work was supported by Chinese National Natural Science Foundation 61272078.
Funding Information:
Acknowledgments. We thank the anonymous reviewers for their helpful feedback. This work was supported by Chinese National Natural Science Foundation 61272078.
Publisher Copyright:
© ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2018.
PY - 2018
Y1 - 2018
N2 - Software reverse engineering has been widely employed for software reuse, serving malicious purposes, such as software plagiarism and malware camouflage. To raise the bar for adversaries to perform reverse engineering, plenty of work has been proposed to introduce obfuscation into the to-be-protected software. However, existing obfuscation methods are either inefficient or hard to be deployed. In this paper, we propose an obfuscation scheme for binaries based on Return Oriented Programming (ROP), which aims to serve as an efficient and deployable anti-reverse-engineering approach. Our basic idea is to transform direct control flow to indirect control flow. The strength of our scheme derives from the fact that static analysis is typically insufficient to pinpoint target address of indirect control flow. We implement a tool, ROPOB, to achieve obfuscation in Commercial-off-the-Shelf (COTS) binaries, and test ROPOB with programs in SPEC2006. The results show that ROPOB can successfully transform all identified direct control flow, without causing execution errors. The overhead is acceptable: the average performance overhead is less than 10% when obfuscation coverage is over 90%.
AB - Software reverse engineering has been widely employed for software reuse, serving malicious purposes, such as software plagiarism and malware camouflage. To raise the bar for adversaries to perform reverse engineering, plenty of work has been proposed to introduce obfuscation into the to-be-protected software. However, existing obfuscation methods are either inefficient or hard to be deployed. In this paper, we propose an obfuscation scheme for binaries based on Return Oriented Programming (ROP), which aims to serve as an efficient and deployable anti-reverse-engineering approach. Our basic idea is to transform direct control flow to indirect control flow. The strength of our scheme derives from the fact that static analysis is typically insufficient to pinpoint target address of indirect control flow. We implement a tool, ROPOB, to achieve obfuscation in Commercial-off-the-Shelf (COTS) binaries, and test ROPOB with programs in SPEC2006. The results show that ROPOB can successfully transform all identified direct control flow, without causing execution errors. The overhead is acceptable: the average performance overhead is less than 10% when obfuscation coverage is over 90%.
UR - http://www.scopus.com/inward/record.url?scp=85045973833&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85045973833&partnerID=8YFLogxK
U2 - 10.1007/978-3-319-78813-5_38
DO - 10.1007/978-3-319-78813-5_38
M3 - Conference contribution
AN - SCOPUS:85045973833
SN - 9783319788128
T3 - Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST
SP - 721
EP - 737
BT - Security and Privacy in Communication Networks - 13th International Conference, SecureComm 2017, Proceedings
A2 - Ghorbani, Ali
A2 - Lin, Xiaodong
A2 - Ren, Kui
A2 - Zhu, Sencun
A2 - Zhang, Aiqing
PB - Springer Verlag
Y2 - 22 October 2017 through 25 October 2017
ER -