# Code Obfuscation

## Layout Obfuscation

Aims to **hide how the source code is structured**

* As source code (or symbols) can present enough information to help reverse a program

Applied to the source code, and focused on situations where the source can be obtained

* Javascript, HTML, CSS, Java

Methods:

* Deleting comments
* Remove debugging information
* Renaming classes, methods and variables
* Removing spaces
* Stripping a binary

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FXNifILmSpJiwlyzX52cX%2Fimage.png?alt=media&#x26;token=2033999a-7553-464e-8a67-41f01f41ccd1" alt=""><figcaption></figcaption></figure>

## Design Obfuscation

Aims at **making the design nonobvious**, and more difficult to recover

* Usually done by a tool before compilation or during compilation
* GCC can do this automatically by inlining functions (`-O3 –finline -funroll-loops`)

Methods:

* Merging and splitting methods
* Merging and splitting classes
* Splitting binary code, while inserting dummy instructions
* Splitting loops and conditions, maybe interleaved with dummy code
* Inlining functions
* Dead Code

### Breaking Code

**Code inserted, but never executed**. JMP before dummy code effectively only splits code

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FqZW0Gwon2MVYbQOKeHFf%2Fimage.png?alt=media&#x26;token=23bd9951-c2f4-4e1b-825e-e0ca0946a5c0" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FLXgzbxx3186f91krSPaF%2Fimage.png?alt=media&#x26;token=052d7228-9b2f-41ec-a204-d112dd5bbf38" alt=""><figcaption></figcaption></figure>

What about the output binary? Compile with `gcc -O0 -o factorial-split factorial-split.c`

Does it affect static or dynamic analysis? Check with `objdump -d` and `ghidra`

What about if instead of jmp you use jz or jnz? `gcc` may also inline functions (the opposite) when using `–O3` or `–finline-functions`

### Dead Code

**Aims at inserting dummy code to confuse the analysis**

* Code may follow some pattern (previous example), or be random
* Code may lock the analysis tool if recursive disassembly is used
* Decompilation to Pseudo C will surely be affected

Dead code can be added after compilation

* May contain fingerprinting information by making binaries unique

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2Fs4dv0Mm0Q2hR4IarB3Ki%2F2024-06-18_17-28.png?alt=media&#x26;token=8df42b65-e7e9-456f-8ce9-81bf522db69e" alt=""><figcaption></figcaption></figure>

## Data Obfuscation

**Encrypts, or otherwise encodes data contents**

* Contents are decrypted in real-time, as the program is executed
* Static analysis, or fingerprint matching may fail to correctly recover useful information
* Frequent tactic to evade filters

Why?

* Strings frequently carry semantic information, that may help analysis
* E.g. Str=“Please input your AES key”: we will know that this is a key, and know the algorithm

### How?

Split the string into parts

* May be combined with two conditions or loops to validate both parts individually

Erase strings right after use

Common XOR is frequently found as it requires no dependencies and is fast

* More recent malware will use RC4 or even AES for this purpose
* The decryption key can also be encrypted, and some keys may be obtained dynamically
  * E.g. from a hardware token as a form of licensing enforcement

Create a custom encoding based on a complex state machine

* May use flow information, voiding the decoding of strings if the execution order it changed

## Control Obfuscation

### Opaque Predicates

Introduces dummy control structures, with little impact on execution

* The impact is only from a performance point of view (additional branch)
* However, analysis tools will interpret the control structures and create complex CFGs

Makes use of Opaque Predicates: predicates for which the programmer already knows the result.

* E.g. `if ( 1 > 0) or v=r; if(v==r)`

Opaque predicates can be more complex

Manipulate pointers, linked lists, use computation processes

The result of a predicate can be dynamic, and related to the execution state

* Dynamic analysis may change the execution sequence, therefore the predicate result and invalidate the execution
* Similar to TPMs, where keys are provided at a valid situation
* Predicate can use dynamic data, received from external services

Concurrency can be used to create predicates

* If two threads are executing with some relation, one can update data, that the other uses to construct a predicate
* Timing information can also be used, to further increase the complexity (information not available statically)

### Control Flow Flattening

**Removes control flow structures from the program.**

* **Converts the program to a gigantic Switch, where each condition is a case**
* The program runs on an **infinite loop around the switch**

The program becomes \~4 times slower, and 2 times larger

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FOWOaUecDz6x8lH4Rs4eP%2Fimage.png?alt=media&#x26;token=a6065568-0699-4193-83f1-1197d659a5cf" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FtmlAKCxIHMtjs990iCvO%2Fimage.png?alt=media&#x26;token=34aa5b13-4a53-4050-a823-40a846c89182" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FiB6csJC1xhKqXx3conxV%2Fimage.png?alt=media&#x26;token=4a77708e-678d-410b-ad62-cf46991319bc" alt=""><figcaption></figcaption></figure>

### Self Decompressing Binaries

Binaries can be compressed into a blob (and even encrypted)

* Stub will process the blob and jump into it

Static analysis will be able to analyze the stub, which can be obfuscated

* Stub provides a valid signature for scanners, but variations can exist

The actual file is never available for analysis by static scanners

* Is available at runtime, as the file must be available for execution
* Generic packers (upx) will pack the entire ELF, which is mapped at runtime
  * Easier to extract as a file is recreated and mapped
* Crafted packers will require more effort

The generic approach uses a debugger or Qiling to dump the uncompressed file

* For an overview, check: <https://kernemporium.github.io/posts/unpacking/>

### Self Decompressing Binaries

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2F28OkmMxHE3cxmwOD6Vwu%2Fimage.png?alt=media&#x26;token=78efedfa-dbd7-46f7-aeb5-b77ecaed3ee2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FvJZMkUP3HHg8sr8VdCeZ%2Fimage.png?alt=media&#x26;token=5d9bbd04-2661-40bf-8afe-c5977b101956" alt=""><figcaption></figcaption></figure>
