一句话：提出 Chisel：用轨迹引导的组合程序合成实现通用控制流反混淆，86% 案例还原出原程序。
代码反混淆旨在简化被故意混淆的代码，是恶意软件检测等安全分析的关键环节，但现有方法大多无法处理修改控制流的混淆，或仅针对特定混淆类型。本文将反混淆建模为程序合成问题：给定混淆程序 P，合成一个 P 的控制流约简且语义等价的最小程序。由于不假设混淆类型，该合成问题极具挑战。作者提出轨迹信息引导的组合式合成算法，利用动态执行轨迹中的线索推断去混淆后的控制流骨架，并将问题分解为各基本块的独立合成。在 Chisel 工具中实现并在 546 个使用六种混淆技术组合的基准上评估，86% 情况下生成代码与原程序几乎相同（仅变量重命名），且显著优于现有技术。
Code deobfuscation, which attempts to simplify code that has been intentionally obfuscated to prevent understanding, is a critical technique for downstream security analysis tasks like malware detection. While there has been significant prior work on code deobfuscation, most techniques either do not handle control flow obfuscations that modify control flow or they target specific classes of control flow obfuscations, making them unsuitable for handling new types of obfuscations or combinations of existing ones. In this paper, we study a new deobfuscation technique that is based on program synthesis and that can handle a broad class of control flow obfuscations. Given an obfuscated program P , our approach aims to synthesize a smallest program that is a control-flow reduction of P and that is semantically equivalent. Since our method does not assume knowledge about the types of obfuscations that have been applied to the original program, the underlying synthesis problem ends up being very challenging. To address this challenge, we propose a novel trace-informed compositional synthesis algorithm that leverages hints present in dynamic traces of the obfuscated program to decompose the synthesis problem into a set of simpler subproblems. In particular, we show how dynamic traces can be useful for inferring a suitable control-flow skeleton of the deobfuscated program and performing independent synthesis of each basic block. We have implemented this approach in a tool called Chisel and evaluate it on 546 benchmarks that have been obfuscated using combinations of six different obfuscation techniques. Our evaluation shows that our approach is effective and that it produces code that is almost identical (modulo variable renaming) to the original (non-obfuscated) program in 86% of cases. Our evaluation also shows that Chisel significantly outperforms existing techniques.
@article{MarianoWPCD24,
title = {Control-Flow Deobfuscation using Trace-Informed Compositional Program Synthesis},
author = {Benjamin Mariano and Ziteng Wang and Shankara Pailoor and Christian Collberg and Işil Dillig},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {OOPSLA2},
year = {2024},
doi = {10.1145/3689789}
}