Opaque Predicates Detection by Abstract Interpretation

Mila Dalla Preda and Roberto Giacobazzi
Department of Computer Science University of Verona}
Strada Le Grazie 15
37134 Verona (Italy)

Matias Madou and Koen De Bosschere
Department of Electronics and Information Systems
Ghent University
St Pietersnieuwstraat 41
B-9000 Ghent, Belgium

Abstract
Code obfuscation is one of the most promising technique to prevent a malicious user from reverse engineering software. In this work we focus on control code obfuscation by opaque predicate insertion. A predicate is opaque when it always evaluates true(false) and it can be used to confuse the malicious user. We first consider a dynamic attack and an hybrid static-dynamic attack, which our experiments show to be time consuming. Then we introduce a novel methodology, based on abstract interpretation theory, for breaking opaque predicates. The main contribution of this work is twofold: on one hand abstract interpretation framework allows us to prove the correctness of this approach, and on the other hand experiments show that this attack significantly reduces the time needed to deobfuscate.