抵御静态反汇编的代码混淆算法  

Code Obfuscation Algorithm to Resist Static Disassembly

作　　者：杨宇波[1] 黄玮[2] 李忠献 胡正名[1] 

机构地区：[1]北京邮电大学信息安全中心,北京100876 [2]中国传媒大学计算机学院,北京100024 [3]国瑞数码安全系统有限公司,北京100088

出　　处：《北京理工大学学报》2015年第3期272-278,共7页Transactions of Beijing Institute of Technology

基　　金：国家科技支撑计划项目(2012BAH37B05)

摘　　要：bf算法是一种针对静态反汇编的混淆算法,但由于bf函数跳转地址的固定性,很容易被逆向还原.据此提出一种基于bf算法的改进型代码混淆算法,利用bf算法中的垃圾指令重定位bf函数的跳转地址并隐藏二次跳转地址,新算法改进了bf算法中的缺陷,同时提升了bf算法针对静态反汇编的混淆复杂度.实验中对测试样本分别进行基于bf算法的混淆和新算法的混淆并使用静态反汇编工具IDA Pro进行测试,实验数据表明新算法在性能和安全性方面有显著的提升.Code obfuscation was employed to prevent the software reverse analysis and protect the important information effectively by strengthening the restore difficult.bf（branch function）algorithm is obfuscation algorithm effective for the static disassembly,but the bf jump is a constant address,so it is easy to be restored.The proposed algorithm based on the bf algorithm improved the defect and enhanced the confusing complexity for the static disassembly,reusing the junk instruction to relocate the bf function jump address and hide the second jump address.In the experiment,the test samples were obfuscated by bf algorithm and the proposed algorithm separately and the static disassembly tool IDA Pro was used for testing,the experimental results show that the new algorithm has significantly improvement in performance and security.

关 键 词：静态反汇编 代码混淆 垃圾指令 信息隐藏 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]