| Code obfuscation, as one of the most currently viable methods for preventing reverse engineering attacks, aims to transform the program into a semantically equivalent one that is much harder to understand for an attacker. And many kinds of code obfuscation transforms are widely used in software protection. However, there aren't any sufficient theories to evaluate the effectiveness of those obfuscation transforms. In fact, little measurement is available about the capability of obfuscation to reduce attackers'efficiency, and little existing theory, which draws upon Software Complexity Metrics from software engineering is convincing.In this paper we take a different way to evaluate the difficulty that attackers have in understanding and modifying obfuscated software through static analysis and dynamic debugging. The process of reverse engineering in our research is mainly divided into three key links, including disassembly, control flow analysis and data flow analysis. And then to abstract some metrics from each key link to quantify to what extent that code obfuscation is able to make attacks more difficult to be performed. Metrics like instruction execution rate, cyclomatic complexity and fan-in fan-out complexity are presented for the character of program attributes during the key sub-process of reverse engineering. Finally, these metrics are implemented to kinds of code obfuscation transformations. Experimental results indicate that these metrics can not only assess the effectiveness of obfuscating transformation itself, but also quantitatively compare the protective effect of different transformations.Code obfuscation evaluation in the view of reverse engineering has been demonstrated to be suited to evaluate and compare obfuscating transformations. The main contribution of this paper is introducing a useful discussion for obfuscating transformation evaluation, which may lights inspiration for evaluating the efficiency of software protection technology. |
PDF Full Text Request