Attack Modeling Technology and Methodology

Software protection continues to evolve rapidly while in the government space, state sponsored reverse engineering teams conduct attacks on binary code. As a result, concern over binary protection has become a matter of national security. This has resulted in a new generation of powerful techniques to secure executable code. Currently, the growth in these defensive technologies has weakened the very tools we rely on to evaluate protection. With first generation reverse engineering tools ineffective, how does one insure that new vulnerabilities have not been introduced alongside the new protections? What do potential second generation attack tools look like? With new binary defenses deployed, our adversaries will eventually develop offensive tools to mitigate the protection. By developing these tools first, we extend the survivability of protected binary beyond what is currently thought to be adequate. This document proposes an approach to building one such second generation technology. This document describes the technology required to build a robust and extendable framework able to support binary protection evaluation. The primary nodes in this framework will be represented by specific second generation attack tools and technologies. The core foundation of this proposed architecture currently exists as the Instruction Interception (I^2) prototype.