Manufacturing cheap, resilient, and stealthy opaque constructs
By Christian S. Collberg, Clark D. Thomborson, Douglas Low. 1998
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
- Davide Maiorca
- Battista Biggio
- Giorgio Giacinto
- Christopher Krügel
- Engin Kirda
- Nicholas Carlini
- Andreas Moser
- Maria Elena Chiappe
Citations in the corpus
- Adversarial Detection of Flash Malware: Limitations and Open Issues (2017, background): “For example, attackers may employ opaque predicates, which are conditional branches that are typically extremely hard to evaluate statically [62].”
- Watermarking, Tamper-Proofing, and Obfuscation-Tools for Software Protection (2002, methodology): “2 Control Transformations In [25] we introduced several control-altering transformations.”
- Dynamic Analysis of Malicious Code (2006, background): “Opaque constants are an extension to the idea of opaque predicates, which are defined in [4] as “boolean valued expressions whose values are known to the obfuscator but difficult to determine for an automatic deobfuscator.”
- Towards Better Program Obfuscation: Optimization via Language Models (2016, background): “To combat potential adversaries, a large group of obfuscation techniques have been developed [8, 10, 21].”
- SoK: Automated Software Diversity (2014, background): “b) Opaque Predicate Insertion: A single-predecessor block b can be substituted with a conditional branch to b and its clone b′ using an arbitrary predicate [14], [16].”
- Limits of Static Analysis for Malware Detection (2007, methodology): “Code obfuscation describes techniques to make it difficult for an attacker to extract high-level semantic information from a program [6, 20].”
- Prevalence and Impact of Low-Entropy Packing Schemes in the Malware Ecosystem (2020, background): “This can be done, for example, by flattening the controlflow, inserting dead code or opaque predicates, or by adding sequences of instructions that can confuse disassemblers ([27], [12], [11], [30], [15], [38]).”