一句话:提出 OCFI,利用 CFI 并非所有函数都需栈展开的事实,混淆函数入口信息,使反汇编器的函数入口识别重新变难。
函数入口识别是二进制反汇编中的关键且困难问题。近年研究表明,调用帧信息(CFI)能为 x64 与 AArch64 架构提供准确且近乎完整的函数入口,显著提升反汇编器的检测效果。然而,CFI 是为高效栈展开设计的,并非每个函数和指令在运行时都会执行栈展开;这一观察为混淆技术留下了空间,可用来干扰基于 CFI 的函数入口识别。OCFI 即针对这一方向,旨在通过混淆/利用 CFI 与运行时栈展开的非必要关系,使函数入口识别重新变难。摘要未给出具体算法与实验评估。
Function entry identification is a crucial yet challenging task for binary disassemblers that has been the focus of research in the past decades. However, recent researches show that call frame information (CFI) provides accurate and almost complete function entries. With the aid of CFI, disassemblers have significant improvements in function entry detection. CFI is specifically designed for efficient stack unwinding, and every function has corresponding CFI in x64 and aarch64 architectures. Nevertheless, not every function and instruction unwinds the stack at runtime, and this observation has led to the development of techniques such as obfuscation to complicate function detection by disassemblers.