Obfuscation of executable code to improve resistance to static disassembly

By Cullen Linn, Saumya K. Debray. Conference on Computer and Communications Security, 2003

745 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/952b38a3dc0d3c7e15fbdec8d6ef1fb3a7319ae1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Renovo: a hidden code extractor for packed executables (2007, methodology): “Such techniques include binary and source code obfuscation [13, 22], control-ﬂow obfuscation [20], instruction virtualization [10], and binary code packing [27].”
Limits of Static Analysis for Malware Detection (2007, methodology): “An obfuscation approach that is orthogonal to the techniques outlined above is presented in [13].”
BinHunt: Automatically Finding Semantic Differences in Binary Programs (2008, background): “In fact, some research even takes advantage of this complexity to obfuscate binary executables to improve their resistance to static analysis [10].”
Exploring Multiple Execution Paths for Malware Analysis (2007, background): “range of obfuscation mechanisms [22, 30] that may make static analysis very difficult.”
SQLrand: Preventing SQL Injection Attacks (2004, methodology): “[ 26 ] uses more general code obfuscation techniques to harden program binaries against static disassembly.”
Dynamic Analysis of Malicious Code (2006, background): “In [9], Linn and Debray introduced novel obfuscation techniques that exploit the fact that the Intel x86 instruction set architecture contains variable length instructions that can start at arbitrary memory address.”
Secure Remote Execution of Sequential Computations (2009, background): “Another solution to the problem we consider in this paper would be for the supervisor to send an obfuscated executable code; however, existing code obfuscation techniques can only result in modest, best-effort efficacy nowadays [14].”
Scalable, Behavior-Based Malware Clustering (2009, background): “Dynamic malware analysis systems have become increasingly popular because they deliver good analysis results even in case of obfuscated or self-modifying code and analysis resistance techniques [34, 38, 44].”
SoK: Automated Software Diversity (2014, background): “c) Branch Function Insertion: Branch functions do not return to their callers; instead, they contain code that determines the return address based on the call site [41].”
Automatic analysis of malware behavior using machine learning (2011, neutral): “Still, static analysis of malware binaries is largely obstructed by obfuscation techniques which are frequently employed by attackers to thwart analysis (e.g., [16,17, 35,46,62]).”
Polymorphic Worm Detection Using Structural Information of Executables (2005, background): “Therefore, when the linear disassembler starts at an address that does not correspond to a valid instruction, it can be expected to re-synchronize with the sequence of valid instructions very quickly [10].”