Random table and hash coding‐based binary code obfuscation against stack trace analysis. Issue 1 (1st January 2016)

• Record Type: Journal Article
• Authors: Xie, Xin; Lu, Bin; Gong, Daofu; Luo, Xiangyang; Liu, Fenlin
• Is Part Of: IET information security. Volume 10:Issue 1(2016)
• Page Start: 18
• Page End: 27
• Publication Date: 2016-01-01
• Subjects: program diagnostics -- reverse engineering -- cryptography; hash coding‐based binary code obfuscation method -- stack trace analysis -- random table -- thwart reverse engineering -- call chains -- stack tracing -- reverse program analysis -- ret instructions -- call instructions; Computer security -- Periodicals; Cryptography -- Periodicals; Computer networks -- Security measures -- Periodicals; Database security -- Periodicals; 005.8
• DOI: 10.1049/iet-ifs.2013.0137
• Languages: English
• ISSNs: 1751-8709

Abstract

Abstract : Code obfuscation is intended to thwart reverse engineering by making programmes hard to understand. Call chains collected by stack tracing can be used to understand the behaviour of programmes. To hinder reverse analysis of stack tracing, a binary code obfuscation method based on random obfuscated table and hash coding is proposed. Random obfuscated table is used to map call addresses while call and ret instructions are executing. Hash coding and random value can be used to encode and decode the data of stack frames in the run‐time programmes. Experiment and analysis show that the obfuscation can effectively impede stack trace analysis and increase the cost of reverse analysis for programmes.