Obfuscation of Abstract Data-Types - Rowan

CHAPTER 2. OBFUSCATIONS FOR INTERMEDIATE LANGUAGE 25
the target label, otherwise the next instruction following the branch will be
executed.
In this example,
IL0001: ldloc.s V
IL0002: ldc.i4.1
IL0003: bge.s IL0020
IL0004: ...
. . .
IL0020: ...
if V ≥ 1 then IL0020 will be executed next — otherwise, IL0004 will be executed.
When writing IL methods, we require that the code that we produce is
verifiable — here are some conditions that must be met for verifiability:
• Stacks must have the same height and contain the same types when control
flow paths meet.
• Operations must have the correct number of items on the stack (e.g. for
a binary operation there must be at least two elements on the stack).
• Operations must receive the type that they expect off the stack
If we have verified code then we can be sure that the code will run safely (e.g. the
code will not access memory locations that it not permitted to) and so we must
ensure that any obfuscations that we apply produce verifiable code.
2.2 IL obfuscations
Now, we will look at how to perform some obfuscations on IL by manually
editing an IL file and assembling this file to make a PE. We look at some of
the obfuscations given in [10] and we show how to write them in IL. The aim
of performing obfuscations on IL is to make it hard for a decompiler to take a
PE and produce C#. Ideally, we would like to stop the decompilation process
altogether but at the very least, we should make the resulting code harder to
understand.
2.2.1 Variable Transformation
For the first example of obfuscating IL, we show how to perform a simple variable
transformation (as outlined in Section 1.3.3). The functions we will use to
perform the transformations are:
f = λi.(2i − 1)
g = λj.((j + 1)/2)
Assignment of a variable corresponds tostloc and use corresponds toldloc.
Using the GCD example given in Figure 2.2, we aim to transform the local