基于3SAT的API调用迷惑方法  

API-calling Obfuscation Method Based on 3SAT

作　　者：陈亚男[1] 王清贤[1] 曾勇军[1] 奚琪[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《计算机工程》2012年第17期119-122,共4页Computer Engineering

摘　　要：现有的API调用迷惑技术通用性不强,且容易被静态分析方法识破。为此,提出一种二进制代码迷惑方法,利用3SAT非透明常量,将API调用的目标地址变换为间接地址,使分析API地址成为NP完全问题,从而无法通过静态分析获取API地址。实验结果表明,该方法增加了代码分析的难度,可使基于API调用的静态分析检测方法失效。There arc some shortages of existing APl-calling obfuscation technology in the fight against the static analysis, such as weak versatility, easy to analyze and so on. This paper proposes a binary code obfuscation method. By using opaque constants based on 3SAT, it builds obfuscation transformations that change the objective address of API-calling to indirect and ensure the address invariable, which makes analyzing API address be an Nondeterministic Polynomial（NP） complete problem, so that the address can not be obtained by static analysis. Experimental results show that the difficulty of analysis of obfuscated program is enhanced, and the method can evade the static detection method based on API-calling.

关 键 词：API调用 静态分析 代码迷惑 3SAT问题 非透明常量 NP完全问题 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]