SATURN --基于LLVM的软件去混淆框架
SATURN -- Software Deobfuscation Framework Based on LLVM
摘要：
近年来，混淆软件的强度有所增加。基于编译器的混淆已经成为业界的事实标准，并且最近的论文还表明，混淆技术的注入是在编译器级别完成的。在本文中，我们讨论了一个通用的方法，去混淆和重新编译的混淆代码的编译框架LLVM的基础上。我们展示了如何将二进制代码提升回编译器中间语言LLVM-IR，并解释了如何使用基于编译器优化和SMT求解的迭代控制流图构造算法恢复混淆的二进制函数的控制流图。我们的方法不会对混淆的代码做出任何假设，而是使用LLVM和Souper Optimizer中提供的强大编译器优化来简化混淆。我们的实验结果表明，这种方法可以有效地削弱甚至消除应用混淆技术，如常数展开，某些基于算术的不透明表达式，死代码插入，伪造的控制流或整数编码中发现的公共和商业混淆。恢复的LLVM-IR可以通过自定义去混淆过程进行进一步处理，这些去混淆过程现在与注入的混淆技术应用在同一级别，或者使用可用的LLVM后端之一进行重新编译。所提出的工作是在一个去混淆工具，称为SATURN。
英文摘要：
The strength of obfuscated software has increased over the recent years. Compiler based obfuscation has become the de facto standard in the industry and recent papers also show that injection of obfuscation techniques is done at the compiler level. In this paper we discuss a generic approach for deobfuscation and recompilation of obfuscated code based on the compiler framework LLVM. We show how binary code can be lifted back into the compiler intermediate language LLVM-IR and explain how we recover the control flow graph of an obfuscated binary function with an iterative control flow graph construction algorithm based on compiler optimizations and SMT solving. Our approach does not make any assumptions about the obfuscated code, but instead uses strong compiler optimizations available in LLVM and Souper Optimizer to simplify away the obfuscation. Our experimental results show that this approach can be effective to weaken or even remove the applied obfuscation techniques like constant unfolding, certain arithmetic-based opaque expressions, dead code insertions, bogus control flow or integer encoding found in public and commercial obfuscators. The recovered LLVM-IR can be further processed by custom deobfuscation passes that are now applied at the same level as the injected obfuscation techniques or recompiled with one of the available LLVM backends. The presented work is implemented in a deobfuscation tool called SATURN.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
