Obfuscation of Abstract Data-Types - Rowan

More documents

Recommendations

Info

CHAPTER 2. OBFUSCATIONS FOR INTERMEDIATE LANGUAGE 23 add beq.s l bge.s l bgt.s l ble.s l blt.s l bne.s l br.s l call div dup ldarg.s v ldc.t v ldloc.s v mul rem ret sub starg.s v stloc.s v Adds the top two elements of the stack Branches to l on equality Branches to l on greater than or equal to Branches to l on greater than Branches to l on less than or equal to Branches to l on less than Branches to l on not equal Unconditional branch to l Calls a method Divides the top two elements of the stack Duplicates the top value of the stack Pushes value of argument v onto the stack Pushes a constant v with type t onto the stack Pushes value of variable v onto the stack Multiplies the top two elements of the stack Calculates the remainder when dividing Returns from a method Subtracts the top two elements of the stack Pops a value and stores it in argument v Pops a value and stores it into v Figure 2.1: Some common IL instructions Figure 2.1. As an example, consider the following C# method which computes the GCD of two integers: public static int gcd(int a, int b) { int x = a; int y = b; while (x !=y) if (x < y) y = y − x; else x = x − y; return x; } After compiling and disassembling this method, we obtain the IL code shown in Figure 2.2. As IL is a typed stack language, each value handled by the stack must have a type associated with it. For example, int32 is the type for 4-byte (32-bit) integers andfloat64 for 8-byte real numbers — number types can also be signed or unsigned. Non numeric types include string and bool. At the start of a method, various properties of the method are stated. First, the signature of the method is given. In the GCD example, we can see that the method expects two integers and returns one integer as the result. Next, the maximum stack depth in the method is specified by using the .maxstack keyword. If we make any changes to the IL code then we should check whether the maximum stack depth has increased and so must change the value of.maxstack accordingly. Finally the names and types of any local variables for this method are stated using the .locals keyword.
CHAPTER 2. OBFUSCATIONS FOR INTERMEDIATE LANGUAGE 24 .method public static int32 gcd(int32 a, int32 b) { .maxstack 2 .locals (int32 V_0, int32 V_1, int32 V_2) } IL0000: ldarg.0 IL0001: stloc.0 IL0002: ldarg.1 IL0003: stloc.1 IL0004: br.s IL0006: ldloc.0 IL0007: ldloc.1 IL0008: bge.s IL000a: ldloc.1 IL000b: ldloc.0 IL000c: sub IL000d: stloc.1 IL000e: br.s IL0014 IL0010 IL0014 IL0010: ldloc.0 IL0011: ldloc.1 IL0012: sub IL0013: stloc.0 IL0014: ldloc.0 IL0015: ldloc.1 IL0016: bne.un.s IL0006 IL0018: ldloc.0 IL0019: stloc.2 IL001a: br.s IL001c: ldloc.2 IL001d: ret Figure 2.2: IL for a GCD method IL001c In the main body of an IL method, instructions can be preceded by a unique label — typically when using ILDASM (the disassembler distributed with .NET) each instruction has a label of the form IL****. Labels are needed for branch instructions. A value from the stack can be stored in a local variable, V , by using the instruction stloc.s V and similarly, a value stored in a local variable V can be pushed on the stack using ldloc.s V . If the local variable that is being accessed is one of the first four variables that was declared in this method, then there is a shorter form of stloc and ldloc. Suppose the local variable were .locals(int32 V, int32 W). Then we could write ldloc.0 or stloc.1 instead of ldloc.s V or stloc.s W, respectively. Values passed to the method are accessed using ldarg and starg. So in the GCD method, ldarg.0 loads the value of “a” onto the stack. We use the command ldc to load constants (with the appropriate type) onto the stack. As with ldloc, there is another form of the instruction: we can write ldc.i4.4 instead of ldc.i4 4 for the integers 0..8 (note that i4 means a 4-byte integer). Arithmetic operations, such as add and sub, take values off the stack and then put the result back onto the stack. For instance, in the following sequence: ldc.i4.7 ldc.i4.2 sub sub will pop 7 and 2 off the stack and push 5 back. Branches can either be unconditional (of the form br) or conditional (such as bne — “jump if not equal to”), which compares values from the stack, and requires a target (corresponding to a label). For a conditional jump, if the condition is true, then the next instruction to be executed will be the one at
Page 1 and 2: Obfuscation of Abstract Data-Types
Page 3 and 4: Contents I The Current View of Obfu
Page 5 and 6: 5.4.3 Third Definition . . . . . .
Page 7 and 8: List of Figures 1 An example of obf
Page 9 and 10: 8 public class c { d t1 = new d();
Page 11 and 12: 10 • Obfuscations can be proved c
Page 13 and 14: Chapter 1 Obfuscation Scully: “No
Page 15 and 16: CHAPTER 1. OBFUSCATION 14 These thr
Page 17 and 18: CHAPTER 1. OBFUSCATION 16 by changi
Page 19 and 20: CHAPTER 1. OBFUSCATION 18 We could
Page 21 and 22: CHAPTER 1. OBFUSCATION 20 B 1 [0] =
Page 23: Chapter 2 Obfuscations for Intermed
Page 27 and 28: CHAPTER 2. OBFUSCATIONS FOR INTERME
Page 45 and 46: Chapter 3 Techniques for Obfuscatio
Page 47 and 48: CHAPTER 3. TECHNIQUES FOR OBFUSCATI
Page 63 and 64: Part III Data-Type Case Studies 62
Page 65 and 66: CHAPTER 4. SPLITTING HEADACHES 64 (
Page 67 and 68: CHAPTER 4. SPLITTING HEADACHES 66 a
Page 69 and 70: CHAPTER 4. SPLITTING HEADACHES 68 T
Page 71 and 72: CHAPTER 4. SPLITTING HEADACHES 70 L
Page 73 and 74: CHAPTER 4. SPLITTING HEADACHES 72 S
Page 75 and 76:
CHAPTER 4. SPLITTING HEADACHES 74 C
Page 77 and 78:
CHAPTER 4. SPLITTING HEADACHES 76 L
Page 79 and 80:
CHAPTER 4. SPLITTING HEADACHES 78 t
Page 81 and 82:
CHAPTER 4. SPLITTING HEADACHES 80 C
Page 83 and 84:
CHAPTER 4. SPLITTING HEADACHES 82 4
Page 85 and 86:
CHAPTER 4. SPLITTING HEADACHES 84 E
Page 87 and 88:
CHAPTER 4. SPLITTING HEADACHES 86 b
Page 89 and 90:
CHAPTER 4. SPLITTING HEADACHES 88 W
Page 91 and 92:
CHAPTER 4. SPLITTING HEADACHES 90 T
Page 93 and 94:
Chapter 5 Sets and the Splitting Bu
Page 95 and 96:
CHAPTER 5. SETS AND THE SPLITTING 9
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
CHAPTER 6. THE MATRIX OBFUSCATED 10
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
Page 117 and 118:
Page 119 and 120:
Page 121 and 122:
CHAPTER 7. CULTIVATING TREE OBFUSCA
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Chapter 8 Conclusions and Further W
Page 137 and 138:
CHAPTER 8. CONCLUSIONS AND FURTHER
Page 139 and 140:
CHAPTER 8. CONCLUSIONS AND FURTHER
Page 141 and 142:
BIBLIOGRAPHY 140 [13] Thomas H. Cor
Page 143 and 144:
BIBLIOGRAPHY 142 [43] Simon Peyton
Page 145 and 146:
Appendix A List assertion We want t
Page 147 and 148:
APPENDIX A. LIST ASSERTION 146 Case
Page 149 and 150:
APPENDIX A. LIST ASSERTION 148 For
Page 151 and 152:
APPENDIX A. LIST ASSERTION 150 Case
Page 153 and 154:
APPENDIX A. LIST ASSERTION 152 1 +
Page 155 and 156:
APPENDIX A. LIST ASSERTION 154 0 +
Page 157 and 158:
APPENDIX A. LIST ASSERTION 156 The
Page 159 and 160:
APPENDIX A. LIST ASSERTION 158 The
Page 161 and 162:
APPENDIX B. SET OPERATIONS 160 Now
Page 163 and 164:
APPENDIX B. SET OPERATIONS 162 Proo
Page 165 and 166:
APPENDIX B. SET OPERATIONS 164 B.2
Page 167 and 168:
Appendix C Matrices We prove the as
Page 169 and 170:
APPENDIX C. MATRICES 168 Base Case
Page 171 and 172:
APPENDIX D. PROVING A TREE ASSERTIO
Page 173 and 174:
Page 175 and 176:
Page 177 and 178:
Page 179 and 180:
Page 181 and 182:
Page 183 and 184:
Page 185 and 186:
Page 187:
APPENDIX E. OBFUSCATION EXAMPLE 186
show all

Obfuscation of Abstract Data-Types - Rowan

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?