Hiding in the Particles: When Return-Oriented Programming Meets Program Obfuscation
Abstract
Largely known for attack scenarios, code reuse techniques at a closer look reveal properties that are appealing also for program obfuscation. We explore the popular return-oriented programming paradigm under this light, transforming program functions into ROP chains that coexist seamlessly with the surrounding software stack. We show how to build chains that can withstand popular static and dynamic deobfuscation approaches, evaluating the robustness and overheads of the design over common programs. The results suggest a significant amount of computational resources would be required to carry a deobfuscation attack for secret finding and code coverage goals.
Keywords
Cite
@article{arxiv.2012.06658,
title = {Hiding in the Particles: When Return-Oriented Programming Meets Program Obfuscation},
author = {Pietro Borrello and Emilio Coppa and Daniele Cono D'Elia},
journal= {arXiv preprint arXiv:2012.06658},
year = {2021}
}
Comments
Published in the proceedings of DSN'21 (51st IEEE/IFIP Int. Conf. on Dependable Systems and Networks). Code and BibTeX entry available at https://github.com/pietroborrello/raindrop