计算机应用 ›› 2018, Vol. 38 ›› Issue (6): 1745-1750.DOI: 10.11772/j.issn.1001-9081.2017122892

• 计算机软件技术 • 上一篇    下一篇

基于符号执行的底层虚拟机混淆器反混淆框架

肖顺陶, 周安民, 刘亮, 贾鹏, 刘露平   

  1. 四川大学 电子信息学院, 成都 610065
  • 收稿日期:2017-12-11 修回日期:2018-02-07 出版日期:2018-06-10 发布日期:2018-06-13
  • 通讯作者: 刘亮
  • 作者简介:肖顺陶(1991-),男,四川仁寿人,硕士研究生,CCF会员,主要研究方向:移动互联网安全;周安民(1963-),男,四川成都人,研究员,主要研究方向:安全防御与管理、移动互联网安全、云计算安全;刘亮(1982-),男,四川成都人,讲师,硕士,主要研究方向:漏洞挖掘、恶意代码分析;贾鹏(1988-),男,河南郑州人,博士,主要研究方向:复杂网络、移动互联网安全、二进制安全;刘露平(1988-),男,四川洪雅人,博士,主要研究方向:二进制安全、漏洞挖掘。

Obfuscator low level virtual machine deobfuscation framework based on symbolic execution

XIAO Shuntao, ZHOU Anmin, LIU Liang, JIA Peng, LIU Luping   

  1. College of Electronics and Information Engineering, Sichuan University, Chengdu Sichuan 610065, China
  • Received:2017-12-11 Revised:2018-02-07 Online:2018-06-10 Published:2018-06-13

摘要: 针对Miasm反混淆框架反混淆后的结果是一张图片,无法反编译恢复程序源码的问题,在对底层虚拟机混淆器(OLLVM)混淆策略和Miasm反混淆思路进行深入学习研究后,提出并实现了一种基于符号执行的OLLVM通用型自动化反混淆框架。首先,利用基本块识别算法找到混淆程序中有用的基本块和无用块;其次,采用符号执行技术确定各个有用块之间的拓扑关系;然后,直接对基本块汇编代码进行指令修复;最后,得到一个反混淆后的可执行文件。实验结果表明,该框架在保证尽量少的反混淆用时前提下,反混淆后的程序与未混淆源程序的代码相似度为96.7%,能非常好地实现x86架构下C/C++文件的OLLVM反混淆。

关键词: Miasm, 底层虚拟机混淆器, 反混淆, 符号执行, 指令修复, 代码相似度

Abstract: The deobfuscation result of deobfuscation framework Miasm is a picture, which cannot be decompiled to recovery program source code. After deep research on the obfuscation strategy of Obfuscator Low Level Virtual Machine (OLLVM) and Miasm deobfuscation idea, a general OLLVM automatic deobfuscation framework based on symbolic execution was proposed and implemented. Firstly, the basic block identification algorithm was used to find useful basic blocks and useless blocks in the obfuscated program. Secondly, the symbolic execution technology was used to determine the topological relations among useful blocks. Then, the instruction repairment was directly applied to the assembly code of basic blocks. Finally, an executable file after deobfuscation was obtained. The experimental results show that, under the premise of guaranteeing the deobfuscation time as little as possible, the code similarity between the deobfuscation program and the non-obfuscated source program is 96.7%. The proposed framework can realize the OLLVM deobfuscation of the C/C ++ files under the x86 architecture very well.

Key words: Miasm, Obfuscator Low Level Virtual Machine (OLLVM), deobfuscation, symbolic execution, instruction repairment, code similarity

中图分类号: