• Journal of KIISE:Software and Applications
• /
• v.35 no.2
• /
• pp.59-69
• /
• 2008

Automatic obfuscation is known to be the most viable method for preventing reverse engineering intentional1y making code more difficult to understand for security purposes. In this paper, we study and implement an obfuscation method for protecting MS Visual C++ programs against attack on the intellectual property in software like reverse engineering attack. That is, the paper describes the implementation of a code obfuscator, a tool which converts a Visual C++ source program into an equivalent one that is much harder to understand. We have used ANTLR parser generator for handling Visual C++ sources, and implemented some obfuscating transformations such as 'Remove comments', 'Scramble identifiers', 'Split variables', 'Fold array', 'Insert class', 'Extend loop condition', 'Add redundant operands', and 'Insert dead code'. We have also evaluated the performance and effectiveness of the obfuscator in terms of potency, resilience, and cost. When the obfuscated source code has been compared with the original source code, it has enough effectiveness for software protection though it incurs some run-time overheads.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.3
• /
• pp.605-615
• /
• 2018

Due to the rapid growth of the Internet of Things market, the use of the C/C++ language, which is the most widely used language in embedded systems, is also increasing. To improve the quality of code in the C/C++ language and reduce development costs, it is better to use static analysis, a software verification technique that can be performed in the first half of the software development life cycle. Many programs use static analysis to verify software safety and many static analysis tools are being used and studied. In this paper, we use Clang static analysis tool to check security weakness detection performance of verified test code. In addition, we compared the static analysis results of the test codes applied with the source obfuscation techniques, layout obfuscation, data obfuscation, and control flow obfuscation techniques, and the static analysis results of the original test codes, Analyze the detection ability impact of the Clang static analysis tool.

• Journal of the Korea Society of Computer and Information
• /
• v.18 no.10
• /
• pp.129-139
• /
• 2013

Java bytecodes are executed not on target machine but on the Java virtual machines. Since this bytecodes use a higher level representation than binary code, it is possible to decompile most bytecodes back to Java source. Obfuscation is the technique of obscuring code and it makes program difficult to understand. However, most of the obfuscation techniques make the code size and the performance of obfuscated program bigger and slower than original program. In this paper, we proposed an effective Java obfuscation techniques using assignment statements merging that make the source program difficult to understand. The basic approach is to merge assignments statements to append side effects of statement. An additional benefit is that the size of the bytecode is reduced.

• Journal of the Korea Society of Computer and Information
• /
• v.24 no.5
• /
• pp.27-33
• /
• 2019

One of serious security threats is a botnet-based attack. A botnet in general consists of numerous bots, which are computing devices with networking function, such as personal computers, smartphones, or tiny IoT sensor devices compromised by malicious codes or attackers. Such botnets can launch various serious cyber-attacks like DDoS attacks, propagating mal-wares, and spreading spam e-mails over the network. To establish a botnet, attackers usually inject malicious URLs into web source codes stealthily by using data hiding methods like Javascript obfuscation techniques to avoid being discovered by traditional security systems such as Firewall, IPS(Intrusion Prevention System) or IDS(Intrusion Detection System). Meanwhile, it is non-trivial work in practice for software developers to manually find such malicious URLs which are hidden in numerous web source codes stored in web servers. In this paper, we propose a security defense system to discover such suspicious, malicious URLs hidden in web source codes, and present experiment results that show its discovery performance. In particular, based on our experiment results, our proposed system discovered 100% of URLs hidden by Javascript encoding obfuscation within sample web source files.

• Proceedings of the Korean Information Science Society Conference
• /
• 2006.10c
• /
• pp.521-525
• /
• 2006

최근 소프트웨어의 주요 알고리즘 및 자료구조 등의 지적재산권을 역공학 분석과 같이 악의적인 공격들로부터 보호하기 위한 연구가 이루어지고 있다. 본 논문에서는 산업 현장에서 많이 사용되는 Visual C++ 또는 MFC로 작성된 프로그램의 소스 코드를 역공학 공격으로부터 보호하기 위한 Obfuscation 도구를 구현하고 그 성능을 평가한다. 구현된 도구는 3가지 Obfuscation 알고리즘을 적용하여 소스 코드를 생성하며 생성된 소스 코드들은 가독성이 떨어지고 역공학 분석이 어렵도록 변환되지만, 프로그램의 본래 기능은 그대로 유지하며 성능상의 변화가 크지 않음을 실험을 통해 확인할 수 있었다.

• The Journal of the Korea Contents Association
• /
• v.16 no.5
• /
• pp.13-20
• /
• 2016

Most software is distributed as a binary file format, so reverse engineering is not easy. But Android is based on the Java and running on virtual machine. So, Android applications can be analyzed by reverse engineering tools. To overcome this problem, various obfuscation techniques are developed. In android environment, the Proguard is most widely used because it is included in the Android SDK distribution package. The Proguard can protect the Java source code from reverse engineering analysis. But it has no function to protect resources like images, sounds and databases. In this paper, we proposed and implemented resource obfuscation framework to protect resources of android application. We expect that this framework can protect android resources effectively.

• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.1
• /
• pp.23-30
• /
• 2015

Reflection is a feature of the Java programming language that can examine and manipulate components of program itself. If you use the reflection, you can get an obfuscation effect of Java source because it converts sources into complicated structures. However, when using it, strings of components name of program are exposed. Therefore, it cannot prevent static analysis. In this paper, we presents a method and a tool of interfere with static analysis using reflection. And in this case, exposed strings are encoded using Vigen$\acute{e}$re cipher. Experimental results show that this tool is effective in increasing the overall complexity of the source code. Also the tool provides two types decryption method based on server and local. It can be selected based on the importance of the API because it affects the execution speed of the application.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2022.11a
• /
• pp.201-203
• /
• 2022

임베디드 시스템이 일상생활 및 각종 산업에 밀접하게 연관되어 개인 정보 및 국가 기술 등 지적 자산에 대한 보안의 필요성이 나타나고 있다. 이러한 문제점은 임베디드 시스템에 들어가는 소프트웨어의 역공학으로부터 초래된다. 따라서 본 논문은 소스 코드에 대해 제어 흐름 평탄화라는 난독화 알고리즘을 설계하는 방법을 제안한다. 이는 독자적으로 작성된 난독화 알고리즘이기 때문에 오픈 소스로 공개되어져 있는 다른 난독화 도구들에 비해 안전한 특징을 가진다. 제어 흐름 평탄화는 프로그램의 기능을 유지하면서 소스 코드의 정적 분석을 어렵게 하는 기법으로, 데이터를 탈취하려는 악의적인 행위를 사전에 예방할 수 있다. 본 논문에서 제안하는 제어 흐름 평탄화 알고리즘은 하나의 기본 블록으로 이루어진 단순한 소스 코드를 여러 개의 기본 블록으로 분할하고, 조건문을 통해 연결하는 방법을 사용하여 알고리즘의 복잡도를 높였다. 이처럼 새롭게 작성된 Pass를 통해 소스코드 난독화를 적용시켜 임베디드 시스템의 보안성을 향상시킬 수 있다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.40 no.4
• /
• pp.709-719
• /
• 2015

This paper introduces a proper renaming service using variable action and security services against the analysis techniques in Java code. The renaming service that is introduced is separated into API pattern and loop condition. We present our scheme algorithm with known Java obfuscation techniques and tools in order to help readers understanding, and implement prototype to prove practicality in this paper. Test result using prototype shows 73% successful variable renaming rate. Using our scheme, cooperators can intuitionally understand all of code. Also, It helps malware analysts to predict malware action by variable name. But application source code that is developed by Java is exposed to hackers easily using our scheme. So we introduce Java application code protection methods, too.