Obfuscation as Instruction Decorrelation

TL;DR

This paper introduces instruction decorrelation as a novel obfuscation method that makes program instructions appear independent, enhancing security while maintaining practicality through specific transformations and trusted execution environments.

Contribution

It formally defines instruction independence, proposes program transformations to achieve it, and demonstrates a practical implementation using trusted execution environments.

Findings

Instruction decorrelation makes instructions appear independent.

Transformations like random interleaving and memory obfuscation meet independence criteria.

Implementation shows feasibility of decorrelation-based obfuscation on real hardware.

Abstract

Obfuscation of computer programs has historically been approached either as a practical but \textit{ad hoc} craft to make reverse engineering subjectively difficult, or as a sound theoretical investigation unfortunately detached from the numerous existing constraints of engineering practical systems. In this paper, we propose \textit{instruction decorrelation} as a new approach that makes the instructions of a set of real-world programs appear independent from one another. We contribute: a formal definition of \textit{instruction independence} with multiple instantiations for various aspects of programs; a combination of program transformations that meet the corresponding instances of instruction independence against an honest-but-curious adversary, specifically random interleaving and memory access obfuscation; and an implementation of an interpreter that uses a trusted execution environment (TEE) only to perform memory address translation and memory shuffling, leaving instructions execution outside the TEE. These first steps highlight the practicality of our approach. Combined with additional techniques to protect the content of memory and to hopefully lower the requirements on TEEs, this work could potentially lead to more secure obfuscation techniques that could execute on commonly available hardware.