Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.compilers > #952

Re: invitation to discussion: code and protocol obfuscation techniques

Show all headers | View raw

Allow me to [try to] kickstart the discussion with an idea (dependent
on, and thus characteristic to) the the split-program structure that i
described (i.e. half trusted, half not, and communicating with
each-other via a communication protocol):

an obfuscated version of the protocol can allow, apart from
introducing new protocol stages and modifying the message format (in
order to render older versions of a program inoperable), also to
introduce *new dependencies in the program*, thus apparently (to me)
having the potential to completely change the program's abstract
syntax tree (AST) beyond recognition; namely:
a) new variables can be introduced, where said variables are
initialized from values coming in messages from the trusted half of
the program (the server in my case); then these variables can be
pollute the program by embedding them in opaque expressions
b) various [known only to the trusted half] relationships between the
newly-introduce variables can exist, thus enabling the creation of
opaque predicates, which in turn can be used to cloak both the program
flow, and to cloak the statistics of a code block (thus making harder
the identification of a code block that performs a given function)
* of course, the above techniques must be assisted by variable codecs
(e.g. variable merging and the likes) in order to hide the
dependencies of an expression on a given (set of) variable(s)

Note that both of the above techniques only work against static
analysis, but i'd be very interested in ideas of how to use my
specific setting (two-half program with half trusted and half not) to
harden dynamic analysis
A suggestion for a starting point: identify various computing
resources that your typical computer has (e.g. multi-threading,
multi-stasking, local loop, etc), and try to figure out how to make
best use of them for obfuscation purposes

Back to comp.compilers | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

invitation to discussion: code and protocol obfuscation techniques "Gyll ." <isiisorisiaint@gmail.com> - 2013-08-01 14:49 +0300
  RE: invitation to discussion: code and protocol obfuscation techniques "Costello, Roger L." <costello@mitre.org> - 2013-08-03 20:58 +0000
  Re: invitation to discussion: code and protocol obfuscation techniques glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2013-08-04 03:41 +0000
  Re: invitation to discussion: code and protocol obfuscation techniques "Gyll ." <isiisorisiaint@gmail.com> - 2013-08-05 13:42 +0300
  Re: invitation to discussion: code and protocol obfuscation techniques "Gyll ." <isiisorisiaint@gmail.com> - 2013-08-05 15:44 +0300
    Re: invitation to discussion: code and protocol obfuscation techniques glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2013-08-06 19:09 +0000
      Re: invitation to discussion: code and protocol obfuscation techniques isiisorisiaint@gmail.com - 2013-08-08 03:24 -0700
        Re: invitation to discussion: code and protocol obfuscation techniques glen herrmannsfeldt <gah@ugcs.caltech.edu> - 2013-08-08 14:41 +0000
          Re: invitation to discussion: code and protocol obfuscation techniques isiisorisiaint@gmail.com - 2013-08-14 08:20 -0700
          Re: invitation to discussion: code and protocol obfuscation techniques Gene Wirchenko <genew@telus.net> - 2013-08-20 19:05 -0700

csiph-web