Protecting Software Binaries from Reverse Engineering

In the context of the Software Protection Initiative, Binary Obfuscation is a technique for transforming existing software binaries into behaviorally equivalent programs that are difficult for an adversary to reverse engineer. Obfuscation is the the mostwidely applicable protection technique for defeating reverse engineering because its protections operate even when an adversary knows the target operating system and processor, and has uncontrolled access to a static copy of the binary. Existing approaches to obfuscation are targeted at obscuring the algorithmic structure of the implementation of software in order to impede the abstraction of this structure by a reverse engineer. Such structural obfuscation techniques are largelyimpotent in the face of a new approach to reverse engineering, what we call Model Theoretic Reverse Engineering (MTRE), that relies only on the symbolically interpreted input/output behavior of the target software, ignoring its implementation structure.The model theoretic approach represents both a promising technology for benign uses of reverse engineering and a largely uncovered liability for the prevention of hostile reverse engineering. It involves the (abstract) interpretation of the target binaryto produce models of the program's input/output, which are then fed to an inductive synthesizer to reconstruct a concise specification in logic of the original program. Although the application of this inductive synthesis technology to reverse engineering is somewhat novel, the technology itself is quite well known and has been broadly developed for uses in software construction, program debugging, and programover the last decade. Its inevitable use in reverse engineering will effectively wipe out the protections offered by most current binary obfuscation techniques. We propose to study the model theoretic approach to reverse engineering to isolate the kinds of obfuscations that might disrupt or impede re-synthesis of program specifications by behavioral interpretation. These obfuscations will be different in kindfrom those currently used to disrupt structural reverse engineering.We also expect to advance the feasibility of benign uses of this technology for applications where reverse engineering is desirable. Anticipated Benefits We anticipate that our research will uncover practical limitations of inductive re-synthesis that can be exploited to protect software binaries from MTRE. Such results should be directly relevant to Defense Agency programs for protecting binariesthe Software Protection Initiative, since they cover a class of reverse engineering techniques not yet addressed in the literature, but immune to most published obfuscation techniques. These results should also be beneficial to business and industry in theprotection of Java Class Files from reverse engineering. We also expect that our research will be beneficial for benign uses of reverse engineering, where the recovery of program specifications is needed to enable reimplementation and integration of legacy systems. The dual use of this technology in support ofreverse engineering should be naturally disjoint with its use in preventing it, because the kind of program obfuscations needed to impede model synthesis are not likely to occur in the normal case of program development, including performance optimization. Potential Commercial Applications Post phase II commercialization of the research proposed here would most naturally be in the form of custom development contracts with specific DoD clients to develop binary obfuscation techniques for specific processor and operating system environments,and perhaps specific application domains. We would also anticipate the use of this technology in engagements involving enhancement, integration or re-implementation of existing software through reverse engineering, or verification/certification ofproperties of existing software through reverse engineering, in both DoD and business markets.