CN107209815B - Method for code obfuscation using return-oriented programming - Google Patents

Abstract

Embodiments of the present invention relate to the use of Return Oriented Programming (ROP) for non-malicious purposes, i.e., for code obfuscation to improve security. Program code associated with a specified function of sensitive nature may be hidden by creating ROP code that performs the specified function of the original (not obfuscated) code and constructing a ROP payload that can be loaded to execute the ROP code. The original code may be replaced with a spurious code not related to the specified function, and a control flow instruction is provided to load the ROP payload to execute the ROP code.

Description

Methods for code obfuscation using return-oriented programming

technical field

Embodiments of the present invention relate to code protection and, more particularly, apply Return Oriented Programming (ROP) to obfuscate code and use it for non-malicious purposes.

Background technique

Obfuscation is an important technique for protecting algorithms and code from disclosure. Application developers often use this technique to protect critical algorithms in a program, making the program's source and machine code incomprehensible.

One existing obfuscation technique involves increasing the difficulty of splitting program code so that only a small portion of the program code is split. Another existing obfuscation technique involves applying encryption to selected instructions so that the encrypted instructions can only be disclosed with the key.

However, these existing obfuscation techniques create limitations. Using the first technique, the code analyzer will realize that only a small portion of the program code is split. Using the second technique, one would question program analysis and raise concerns during encryption and decryption processing.

SUMMARY OF THE INVENTION

Embodiments of the present invention relate to the use of Return Oriented Programming (ROP) for non-malicious purposes, ie, for code obfuscation to improve security. Code associated with a specified function of a sensitive nature can be concealed by creating ROP code that performs the specified function of the original (unobfuscated) code and constructing a ROP payload that can be loaded to execute the ROP code. The original code can be replaced with stray code unrelated to the specified functionality, and control flow instructions are provided to load the ROP payload to execute the ROP code.

According to one aspect of the present invention, a method of executing obfuscated code is provided. The method includes:

In a mobile device having a ROP embedded host program, the ROP payload is retrieved in response to invoking a specified function associated with client code omitted from the ROP embedded host program, the ROP embedded host program containing means for executing the ROP code for the specified function; and

The mobile device's memory registers are reset using the ROP payload, thereby executing the ROP code for carrying out the calling function associated with the client code.

In one embodiment of the above method, retrieving the ROP payload includes sending a request from the mobile device to obtain data associated with the invoking function to a remote server, and receiving both the requested data and the ROP payload from the server .

In another embodiment of the above method, retrieving the ROP payload includes retrieving the ROP payload from a memory device in the mobile device.

According to another aspect of the present invention, a code obfuscation method is provided. The method includes:

identifying, from host program code having client code, a plurality of fragments associated with the client code and determining a plurality of return addresses corresponding to the fragments;

Create the ROP code of the connected segment by modifying the return address to be stored in the memory register, wherein the ROP code will perform the specified function of the client code;

constructing a ROP payload containing the parameter data required by the client code, the return address of the segment, and a data segment for resetting memory registers to execute the ROP code;

Replace client code in host program code with stray code;

Provides command codes for resetting memory registers with the ROP payload; and

A ROP payload is stored at a memory device for being invoked at runtime to execute ROP code for performing specified functions associated with client code.

In one embodiment of the above method, the memory device is located at a server computer remote from the mobile device on which the ROP embedded host program containing the ROP code will be installed.

In another embodiment of the above method, the memory device is located at the mobile device on which the ROP embedded host program containing the ROP code is to be installed.

According to another aspect of the present invention, a mobile device is provided, and the mobile device includes:

a processor, and a memory device having a ROP embedded host program containing ROP code for carrying out specified functions associated with guest code omitted from the ROP embedded host program , the processor is used to:

retrieving a ROP payload in response to invoking the specified function; and

The mobile device's memory registers are reset using the ROP payload, thereby executing the ROP code for carrying out the calling function associated with the client code.

In one embodiment of the above apparatus, the processor is configured to retrieve the ROP payload by sending a request to obtain data associated with the calling function to a remote server and receiving both the requested data and the ROP payload from the server.

In another embodiment of the above apparatus, the processor is to retrieve the ROP payload by retrieving the ROP payload from a memory device in the mobile device.

In another embodiment of the above apparatus, the processor is configured to effect authorization to retrieve the ROP payload by validating external input prior to retrieving the ROP payload.

Description of drawings

The present invention will be described in detail with reference to the accompanying drawings, in which:

Figure 1A shows a host program (eg, a music player);

FIG. 1B shows client code (eg, license verification code) to be obfuscated;

Figure 1C shows the client code of Figure 1B after code obfuscation;

FIG. 2 illustrates a code obfuscation method according to one embodiment of the present invention; and

Figure 3 illustrates a method for executing obfuscated client code according to one embodiment of the present invention.

Detailed ways

In the following description, numerous specific details are set forth to provide a thorough understanding of various embodiments of the present invention. However, one skilled in the art will understand that embodiments of the present invention may be practiced without some or all of these specific details. In other instances, well-known process operations have not been described in detail in order not to unnecessarily obscure relevant aspects of the described embodiments. In the drawings, the same reference numerals refer to the same or similar functionality or features throughout the several views.

Embodiments of the present invention disclose a new obfuscation technique using Return Oriented Programming (ROP).

ROP has become one of the most effective runtime attack techniques in recent years. Attackers using ROP often identify fragments from valid code sequences as a first step. A fragment may be referred to as a small fragment of a valid code sequence, and more specifically, may be referred to as a sequence of instructions that potentially begins in the middle of existing machine instructions and ends with a return instruction. Recognition fragments provide the basic units that form the ROP program. In the second step, the control flow of the program becomes the address of the first segment in the ROP program. Since each fragment ends with a return instruction, when the first fragment returns, the program can "return" to the second fragment, where such addresses are carefully prepared on registers. If a fragment contains a popup-like instruction, it will get parameters from a register, which should also be placed on the register, just after the return address of the fragment. In summary, ROP basically gathers pieces of valid code from existing instructions in a program to form another program that performs a specific function and alters the control flow of the original program.

ROP is traditionally used for malicious attacks on vulnerable programs. In contrast, embodiments of the present invention employ ROP for non-malicious purposes, ie, protecting and hiding program code, and by embedding the ROP during application development.

1A to 1C illustrate non-limiting examples to which the present invention may be applied. FIG. 1A shows a host program (eg, a music player) with client code (eg, a license verification code) as shown in FIG. 1B . The license verification code will be obfuscated, making it impossible for an adversary to forge a new license file, eg by reverse engineering. Figure 1C shows the client code of Figure 1B after code obfuscation;

FIG. 2 shows a code obfuscation method 200 . The method 200 will be described with reference to the example in FIGS. 1A-1C where the host program is Android based and written using native code (C/C++).

In block 202, the client code within the host program is identified for code obfuscation. Here, the client code is unobfuscated and the host program is in non-ROP form.

In block 204, the host program code and native libraries are analyzed to identify useful fragments (ROP fragments) associated with the client code. A return address corresponding to the identified fragment is also determined.

To locate these fragments, semi-automatic tools can be developed that support both so files and apk files on the ARM architecture. The tool is used to analyze host programs (eg, Android applications), native libraries in the Android system, and libraries in the Android installation package, and determine return addresses corresponding to the identified fragments.

In block 206, the identified segments are linked or concatenated together to create a ROP code. This is accomplished by modifying the return address stored in the memory register (as determined in block 204). The ROP code, when executed, will perform the specified function associated with the client code.

In block 208, a ROP payload is constructed, which is used to alter the control flow of the host program and thereby execute obfuscated guest code (ROP code).

To alter the flow of control, the setjmp() and longjmp() subroutines for providing non-local jumps as defined in the C standard library can be used. As defined by jmp_buf, Setjmp() will save the contents of the calling environment or memory registers so that longjmp() can restore them. In this way, longjmp() "returns" to the state of the program when setjmp() is called. Therefore, jmp_buf holds the information needed to restore the calling environment.

Since the jmp_buf held by setjmp() will be altered through a heap overflow vulnerability, the ROP payload should contain (i) the parameter data required by the client code, (ii) the return address of the identified fragment (as previously determined in block 204), and (iii) a data segment for resetting memory registers to execute the ROP code.

In block 210, the guest code is removed from the host program code. Provide or embed stray code in place of customer code. After the stray code, the command code for resetting the memory registers with the ROP payload is provided. Specifically, the longjmp() subroutine is provided to reset the calling environment and to provide a mechanism for changing the return address of the host program.

In block 212, the APK file containing the host program code including stray code and ROP code is repackaged and signed. The APK files are accordingly distributed and installed as ROP embedded host programs in various mobile devices. Such mobile devices are known in the art and include at least a processor and a memory device containing instructions executable by the processor to cause the mobile device to perform various operations.

In block 214, the ROP payload is stored in the memory device to be invoked at runtime to execute the ROP code that will perform the specified function associated with the client code. In one embodiment, the ROP payload is stored in a memory device at the remote server computer. In another embodiment, the ROP payload is stored in a memory device of the mobile device.

Below in light of the above, FIG. 3 illustrates a method 300 for executing obfuscated client code.

In block 302, a mobile device with the ROP embedded host program installed is provided. Specifically, in the ROP embedded host program, the preselected client code has been obfuscated in the form of ROP code. When invoking a specified function associated with the obfuscated client code (eg, the license verification function in FIG. 1A ), in response, the mobile device sends a data request associated with the invoking function to the remote server computer. The mobile device also executes stray code not generally associated with calling functions.

In block 304, the remote server responds with data typically associated with the calling function. The ROP payload is also retrieved from a remote server or mobile device with the ROP embedded host program installed.

In one embodiment where the ROP payload is stored in a memory device at the remote server, the remote server additionally responds with the ROP payload pre-stored in the remote server.

In another embodiment where the ROP payload is stored in a memory device at the mobile device, the pre-stored ROP payload in the mobile device is retrieved after invoking the function. In this embodiment, invoking the obfuscated client code may be automatic (unconditional), or use an external input preconfigured to trigger execution of the obfuscated client code (conditional). For example, authorization of the ROP payload retrieval is effected by validating external input that may be received from a user of the mobile device prior to retrieving the ROP payload from the memory device.

In block 306, the retrieved ROP payload is applied to reset the mobile device's memory registers. Thus, the original calling context is restored, and control flow returns to the host program, executing the ROP code for carrying out the specified functionality associated with the obfuscated guest code.

The above disclosure is described with reference to an Android-based application. It should be appreciated that embodiments of the present invention are suitable for application to other platforms, including x86 and SPARC.

As will be appreciated from the above, embodiments of the present invention overcome the limitations of existing obfuscation techniques and provide several advantages and differences, including but not limited to the following:

By using ROP, the code to be obfuscated takes the form of ROP when embedded in the host program. The ROP embedded host program can be split completely and successfully, so there will be no question of code obfuscation.

Change the control flow of the host program by rewriting the return address in the host program. When using the ROP technique, the static analysis will not be able to detect the return address of the program (runtime concept). At runtime, some of the return addresses will become the addresses of the ROP fragments.

In some embodiments, a remote server is used to control the properties after invoking a preselected program function. Specifically, the server sends a ROP payload to the mobile device containing the return address of the ROP fragment. The payload is not accessible using the static analysis of the host program. Therefore, the ROP payload controls the invocation of obfuscated client code at runtime.

Use native code to change the Android application, especially the embedding mechanism to modify the jmp_buf or return address.

Now ROP is used for non-malicious purposes and is actually used to improve security. Since ROP occurs during program development, the program is completely under the control of the developer who is also the ROP constructor. Therefore, developers can modify any aspect of the program to enable ROP embedding. The existing ROP technology is applied to malicious attacks, in which the ROP constructor cannot change the instructions in the program.

A semi-automatic tool for analyzing fragments in an Android application can be provided that supports apk files and libraries to be used by the application, including native libraries and apk files in the Android system.

Other embodiments will be apparent to those skilled in the art upon consideration of this specification and practice of the invention. Furthermore, certain terms are used for the purpose of clarity of description and do not limit the disclosed embodiments of the invention. The embodiments and features described above should be considered as exemplary.

Claims (18)

1. a method for executing obfuscated code, wherein the method comprises: In a mobile device with a return-oriented programming ROP embedded host program, a ROP payload is retrieved in response to invoking a specified function associated with client code omitted from the ROP embedded host program, the ROP embedded host program comprising ROP codes for carrying out the specified functions; and A memory register of the mobile device is reset using the ROP payload, thereby executing the ROP code for carrying out the calling function associated with the client code. 2. The method of claim 1, wherein retrieving a ROP payload comprises sending a request from a mobile device to obtain data associated with the invoking function to a remote server, and receiving the data from the server. Both the requested data and the ROP payload. 3. The method of claim 1, wherein retrieving a ROP payload comprises retrieving the ROP payload from a memory device in the mobile device. 4. The method of claim 3, further comprising: Authorization to retrieve the ROP payload is effected by validating external input prior to retrieving the ROP payload from the memory device in the mobile device. 5. The method according to claim 1, wherein the ROP embedded host program is an Android application. 6. The method of claim 1, wherein the ROP payload contains parameter data required by the client code, return addresses forming a plurality of fragments of the ROP code, and a method for resetting all the memory register to execute the data segment of the ROP code. 7. The method according to any one of claims 1 to 5, wherein the ROP embedded program is prepared by the following steps: Identifying a plurality of fragments associated with the client code from the non-ROP host program code having the client code and determining a plurality of return addresses corresponding to the fragments; creating the ROP code connecting the fragment by modifying the return address to be stored in a memory register; constructing the ROP payload containing parameter data required by the client code, the return address for the segment, and a data segment for resetting the memory registers to execute the ROP code ; replacing the client code in the host program code with stray code; providing a command code for resetting the memory register with the ROP payload; and The ROP payload is stored. 8. A code obfuscation method, comprising: identifying, from host program code having client code, a plurality of fragments associated with the client code and determining a plurality of return addresses corresponding to the fragments; Creating a return-oriented programming ROP code connecting the fragment by modifying the return address to be stored in a memory register, wherein the ROP code will perform the specified function of the client code; constructing a ROP payload containing parameter data required by the client code, the return address for the segment, and a data segment for resetting the memory registers to execute the ROP code; replacing the client code in the host program code with stray code; providing a command code for resetting the memory register with the ROP payload; and The ROP payload is stored at a memory device, wherein the ROP payload is for being invoked at runtime to execute the ROP code for carrying out the specified function associated with the client code. 9. The method of claim 8, wherein the memory device is located at a server computer remote from the mobile device on which the ROP embedded host program containing the ROP code is to be installed. 10. The method of claim 8, wherein the memory device is located at a mobile device on which a ROP embedded host program containing the ROP code is to be installed. 11. The method of claim 8, wherein the host program is an Android application. 12. A mobile device, comprising: a processor, and a memory device having a return-oriented programming ROP embedded host program, the ROP embedded host program containing specified functions for performing specified functions associated with guest code omitted from the ROP embedded host program The ROP code, the processor is used to: retrieving a ROP payload in response to invoking the specified function; and A memory register of the mobile device is reset using the ROP payload, thereby executing the ROP code for carrying out the calling function associated with the client code. 13. The apparatus of claim 12, wherein the processor is configured to receive the requested data from the server by sending a request to obtain data associated with the calling function to a remote server and both the ROP payload to retrieve the ROP payload. 14. The device of claim 12, wherein the processor is to retrieve the ROP payload by retrieving the ROP payload from the memory device in the mobile device. 15. The apparatus of claim 14, wherein the processor is to enforce authorization to retrieve the ROP payload by validating external input prior to retrieving the ROP payload. 16. The device of claim 12, wherein the ROP embedded host program is an Android application. 17. The apparatus of claim 12, wherein the ROP payload contains parameter data required by the client code, return addresses forming a plurality of fragments of the ROP code, and instructions for resetting all the memory register to execute the data segment of the ROP code. 18. The apparatus according to any one of claims 12 to 16, wherein the ROP embedded program is prepared by the following steps: Identifying a plurality of fragments associated with the client code from the non-ROP host program code having the client code and determining a plurality of return addresses corresponding to the fragments; creating the ROP code connecting the fragment by modifying the return address to be stored in a memory register; constructing the ROP payload containing parameter data required by the client code, the return address for the segment, and a data segment for resetting the memory registers to execute the ROP code ; replacing the client code in the host program code with stray code; providing a command code for resetting the memory register with the ROP payload; and The ROP payload is stored.

Images