APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity
-
Published:2023-08-08
Issue:16
Volume:13
Page:9056
-
ISSN:2076-3417
-
Container-title:Applied Sciences
-
language:en
-
Short-container-title:Applied Sciences
Author:
Li Yang1ORCID, Kang Fei1, Shu Hui1, Xiong Xiaobing1, Zhao Yuntian1, Sun Rongbo1ORCID
Affiliation:
1. State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China
Abstract
API calls are programming interfaces used by applications. When it is difficult for an analyst to perform a direct reverse analysis of a program, the API provides an important basis for analyzing the behavior and functionality of the program. API address spaces are essential for analysts to identify API call information, and therefore API call obfuscation is used as a protection strategy to prevent analysts from obtaining call information from API address spaces. API call obfuscation avoids direct API calls and aims to create a more complex API calling process. Unfortunately, current API call obfuscation methods are not effective in preventing analysts from obtaining usable information from the API address space. To solve this issue, in this paper, we propose an API call obfuscation model based on address space obscurity. The key functions within the API are encrypted and moved to the user code space for execution. This breaks the relationship between the API and its address space, making it impossible for analysts to obtain address information about a known API from the API address space. In our experiments, we developed an archetypical compiler-level API call obfuscation system to automate the obfuscation of input source code into an obfuscated file. The results show that our approach can thwart existing API deobfuscation techniques and is highly resistant to various open-source dynamic analysis platforms. Compared to other obfuscation techniques, our scheme improves API address space obscurity by more than two times, the detection rate of deobfuscation techniques such as Scylla, etc. is zero, and the increase in obfuscation overhead is not more than 20%. The above results show that APIASO has better obfuscation effect and practicability.
Funder
National Key R&D Program of China
Subject
Fluid Flow and Transfer Processes,Computer Science Applications,Process Chemistry and Technology,General Engineering,Instrumentation,General Materials Science
Reference25 articles.
1. Choi, J., Kim, K., Lee, D., and Cha, S.K. (2021, January 24–27). NTFuzz: Enabling type-aware kernel fuzzing on windows with static binary analysis. Proceedings of the 2021 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA. 2. Lattner, C., and Adve, V. (2004, January 20–24). LLVM: A compilation framework for lifelong program analysis & transformation. Proceedings of the International Symposium on Code Generation and Optimization, CGO 2004, San Jose, CA, USA. 3. Kawakoya, Y., Shioji, E., Otsuki, Y., Iwamura, M., and Yada, T. (2017, January 18–20). Stealth loader: Trace-free program loading for API obfuscation. Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses, Atlanta, GA, USA. 4. Cheng, B., Ming, J., Leal, E.A., Zhang, H., Fu, J., and Peng, G. (2021, January 11–13). Obfuscation-Resilient Executable Payload Extraction From Packed Malware. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Virtual. 5. Suenaga, M. (2009). A Museum of Api Obfuscation on Win32, Symantec Corp. Symantec Security Response.
|
|