一句话：提出一种歧义翻译反分析技术，将代码片段编码，并用状态机产生多个难以区分的解码结果以对抗程序分析。
本文研究一种新的反分析技术，专门针对现有程序分析方法的薄弱点。该方法将待隐藏的程序代码片段编码，解码过程由复杂状态机实现，能根据输入产生多个输出；其核心是歧义化解码，使同一编码产生多个彼此难以区分的解码代码片段，从而干扰分析。与已有类似方法不同，它在正确解码与错误解码时执行行为没有明显差异，因此更隐蔽。论文还分析现有技术的弱点并讨论潜在改进。作者实现概念验证并评估，初步结果表明该技术给程序分析带来多种新挑战。
This research explores the possibility of a new anti-analysis technique, carefully designed to attack weaknesses of the existing program analysis approaches. It encodes a program code snippet to hide, and its decoding process is implemented by a sophisticated state machine that produces multiple outputs depending on inputs. The key idea of the proposed technique is to ambiguously decode the program code, resulting in multiple decoded code snippets that are challenging to distinguish from each other. Our approach is stealthier than previous similar approaches as its execution does not exhibit different behaviors between when it decodes correctly or incorrectly. This paper also presents analyses of weaknesses of existing techniques and discusses potential improvements. We implement and evaluate the proof of concept approach, and our preliminary results show that the proposed technique imposes various new unique challenges to the program analysis technique.
DOI 原文 ·
@inproceedings{paperbot6524,
title = {Defeating Program Analysis Techniques via Ambiguous Translation},
author = {Chijung Jung and Doowon Kim and Weihang Wang and Yunhui Zheng and Kyu Hyung Lee and Yonghwi Kwon},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678912}
}