采用隐式跳转的控制流混淆技术  

Control Flow Obfuscation Technology Based on Implicit Jump

作　　者：陈耀阳 陈伟[1] CHEN Yaoyang;CHEN Wei(College of Computer,Nanjing University of Posts and Telecommunications,Nanjing 210023,China)

机构地区：[1]南京邮电大学计算机学院,南京210023

出　　处：《计算机工程与应用》2021年第20期125-132,共8页Computer Engineering and Applications

摘　　要：传统的控制流混淆方案是通过引入一些特殊结构来混淆或隐藏原程序的控制流信息,但这会导致大量的额外开销,此外针对控制流中其他敏感信息,常用的混淆技术并没有完善的保护方案。针对这些问题,提出了基于隐式跳转的控制流混淆技术。分析建立程序的控制流图,获取每个基本块的依赖关系,建立状态转移模型,为每个基本块分配一个运行时状态,并根据该状态生成的密钥来对控制流的跳转、函数的调用及变量的引用等敏感信息进行加密保护,使之转换为需要在运行时解密才能使用的隐式形式,从而实现反静态分析。此外,针对相同对象的密文重复问题,提出了基于环境密钥的两阶段加密方案,进一步减少敏感信息的暴露。实验结果表明,该方案并不会对程序运行时性能造成很大影响,同时还能较为完善地帮助程序抵抗静态分析。The traditional control flow obfuscation schemes introduce some special structures to obfuscate or hide the control flow information of the original program,but this will cause a lot of extra overhead.In addition,for sensitive information in the control flow,the commonly used obfuscation techniques do not have complete protection in program.To solve these problems,a control flow obfuscation technique based on implicit jump is proposed.First the control flow diagram of the program is analyzed and established to obtain the dependencies of each basic block;then a state transition model is established to assign a runtime state to each basic block;finally,the proposed method encrypts and protects sensitive information such as control flow jumps,function calls,and variable references based on the keys generated by this state.These sensitive information are converted into an implicit form that needs to be decrypted at runtime to achieve anti-static analysis.In addition,in view of the duplication of ciphertexts of the same object,a two-stage encryption scheme based on environmental keys is proposed to further reduce the exposure of sensitive information.Experimental results show that compared with the traditional obfuscation technology,this scheme will not have a great impact on the runtime performance of the program,and it can also help the program resist static analysis more comprehensively.

关 键 词：控制流图 代码混淆 隐式跳转 反静态分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]