Extended Report on the Obfuscated Integration of Software Protections

TL;DR

This paper introduces a novel obfuscation method combining multiple techniques to protect software from reverse engineering and tampering, demonstrating its effectiveness through extensive experiments.

Contribution

It presents a new combined obfuscation approach that significantly enhances resistance to disassembly and code analysis attacks.

Findings

Effective thwarting of disassembly and code reconstruction

High resilience demonstrated against advanced reverse engineering tools

Publicly available code facilitates reproducibility and further research

Abstract

To counter man-at-the-end attacks such as reverse engineering and tampering, software is often protected with techniques that require support modules to be linked into the application. It is well-known, however, that attackers can exploit the modular nature of applications and their protections to speed up the identification and comprehension process of the relevant code, the assets, and the applied protections. To counter that exploitation of modularity at different levels of granularity, the boundaries between the modules in the program need to be obfuscated. We propose to do so by combining three cross-boundary protection techniques that thwart the disassembly process and in particular the reconstruction of functions: code layout randomization, interprocedurally coupled opaque predicates, and code factoring with intraprocedural control flow idioms. By means of an elaborate experimental evaluation and an extensive sensitivity analysis on realistic use cases and state-of-the-art tools, we demonstrate our technique's potency and resilience to advanced attacks. All relevant code is publicly available online.