ST-CRTS: Dynamic Unmasking of Compiler Optimizations and Obfuscations

University Of Arizona, Tucson AZ

Investigators

Abstract

Background In this project the PI argues that many applications, related to software reliability and software protection, require automated comparison of original and the transformed versions of the program. The goal of this comparison is to match instructions from two versions that correspond to each other. The PI refers to this process of automatically unmasking the effects of program transformations as matching. Intellectual Merit: -The PI propose to develop nearly accurate dynamic matching algorithms which are designed to -Use execution histories to find mapping between code that appears to be different but behaves the same during an execution. -Perform matching at binary level. -Use matching to compare execution histories of the two versions at regular intervals and report the set of unmatched statements. -Combination of techniques that use Diablo to produce a static program representation and runtime algorithms that process Valgrind generated traces for compression are being implemented to produce Whole Execution Traces (WETs). -Deposit in a WET database and accessed by the Dynamic Matching module to carry out matching. Broader Impact The PI has involved 2 PhD students in the preliminary work carried out for the proposed research. These students are expected to finish their degrees by the end of the proposed project. In addition, other graduate and undergraduate students in Programming Languages classes taught by the PI will use the infrastructure in their class projects. Initially the research results produced by this project will be incorporated into the above courses taught by the PI. Later PI will develop a dedicated course on Dynamic Techniques. The labs and lectures prepared will be freely made available through the project website. Once such a course is ready, the PI will also undertake a book writing project to produce a formal text in the broader area of dynamic analysis. Although the initial goal of this research is to develop dynamic unmasking techniques for optimized and obfuscated code, the dynamic information analysis infrastructure that is being developed will also be useful in other areas of research such as performance analysis and debugging. Therefore, the infrastructure produced will be have a broader impact by being useful to other researchers as well.