Paper  abstract   bibtex   

@phdthesis{ninon_eyrolles_obfuscation_2017,
	type = {{PhD}},
	title = {Obfuscation with {Mixed} {Boolean}-{Arithmetic} {Expressions}:  {Reconstruction}, {Analysis} and {Simplification} {Tools}},
	url = {https://blog.quarkslab.com/resources/2017-06-09-nouthese-soutenance/thesis.pdf},
	abstract = {Software obfuscation is a software protection technique that transforms code in order to make its analysis more difficult by reverse-engineering. Mixed Boolean-Arithmetic (MBA) expressions are an obfuscation technique introduced in 2007 and used in real life products. They are presented as a strong data flow obfuscation technique, even though there is little literature on the design and analysis of such obfuscated expressions. In our study, we structured the subject of MBA obfuscation and linked it to other topics, mainly cryptography, rewriting and bit-vector logic. We also reconstructed an MBA obfuscation implementation from public samples. We studied the meaning of simplifying an obfuscated expression, and defined our own simplicity metrics for MBA expressions. Our study of MBA simplification yielded the implementation of two deobfuscation tools that successfully simplified several public examples of obfuscated expressions. Finally, we assessed the resilience of the MBA obfuscation with respect to our simplification algorithms (as well as other deobfuscation techniques), concluding that the MBA obfuscation technique offers little resilience as it is, and we proposed new ideas to improve it.},
	school = {Université Paris Saclay},
	author = {{Ninon Eyrolles}},
	month = jun,
	year = {2017},
	note = {https://github.com/quarkslab/sspam/},
	keywords = {Mixed Boolean-Arithmetic, Obfuscation, Software protection, uses sympy},
}