Systems and methods for deobfuscation of executable code
Systems, devices, and methods are discussed that provide for discovering protected data from a code. Such detection provides an ability to discover potentially malicious code and/or datasets obfuscated within a code prior to full execution of the code.
1. A method for code deobfuscation, the method comprising:
identifying, by a processing resource, a dispatcher node in a graphical intermediate representation of an executable code;
identifying, by the processing resource, at least one work item, wherein the at least one work item is a path through the dispatcher node and includes at least one operation node in addition to the dispatcher node;
proving, by the processing resource, a branch behavior of the dispatcher node, wherein proving the branch behavior includes applying at least one algorithm to the work item to yield at least one solution path, wherein the at least one solution path is included in a solution set; and
modifying, by the processing resource, the graphical intermediate representation of the executable code to yield a modified graphical intermediate representation, and wherein the dispatcher node is eliminated from the modified graphical intermediate representation, wherein
the at least one operation node is a first operation node;
the path through the dispatcher node is a first path through the dispatcher node; and
the at least one algorithm is a direct algorithm, wherein
proving the branch behavior of the dispatcher node further comprises:
determining, by the processing resource, that application of the direct algorithm to the work item fails to yield any solution path;
identifying, by the processing resource, a second path through the dispatcher node that includes a second operation node in addition to the first operation node; and
applying, by the processing resource, the direct algorithm to the second path through the dispatcher node to yield the at least one solution path.
2. The method of claim 1 , wherein the modified graphical intermediate representation is in SSA format.
3. The method of claim 1 , wherein the path through the dispatcher node
ends at the dispatcher node; and
includes only one instance of any given operation node.
4. The method of claim 1 , wherein modifying the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation comprises:
reducing, by the processing resource, the solution set to yield a solution reduction tree.
5. The method of claim 4 , wherein modifying the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation further comprises:
extracting, by the processing resource, paths from the solution reduction tree to yield a solution.
6. The method of claim 5 , wherein modifying the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation further comprises:
actualizing, by the processing resource, the solution to yield an actualized solution corresponding to the branch of the graphical intermediate representation wherein the modified graphical intermediate representation includes the actualized solution.
7. The method of claim 1 , wherein the second path through the dispatcher node
ends at the dispatcher node; and
includes only one instance of any given operation node.
8. The method of claim 1 , wherein the second path through the dispatcher node meets the following criteria: where there is a single predecessor operation node to the first node of the first path, the single predecessor operation node is prepended to the first operation node.
9. The method of claim 1 , wherein the at least one algorithm includes a direct algorithm, and wherein proving the branch behavior of the dispatcher node further comprises:
determining, by the processing resource, that application of the direct algorithm to the work item failed to yield the solution path; and
applying, by the processing resource, a symbolic algorithm to the identified control flow problem to yield the solution set.
10. A system for code deobfuscation, the system comprising:
a processing resource;
a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
identify a dispatcher node in a graphical intermediate representation of an executable code;
identify at least one work item, wherein the at least one work item is a path through the dispatcher node and includes at least one operation node in addition to the dispatcher node;
prove a branch behavior of the dispatcher node, wherein proving the branch behavior includes applying at least one algorithm to the work item to yield at least one solution path, wherein the at least one solution path is included in a solution set; and
modify the graphical intermediate representation of the executable code to yield a modified graphical intermediate representation, and wherein the dispatcher node is eliminated from the modified graphical intermediate representation,
wherein
the at least one operation node is a first operation node;
the path through the dispatcher node is a first path through the dispatcher node; and
the at least one algorithm is a direct algorithm, wherein
the instructions that when executed by the processing resource to cause the processing resource to prove the branch behavior of the dispatcher node includes instructions executable by the processing resource to:
determine that application of the direct algorithm to the work item fails to yield any solution path;
identify a second path through the dispatcher node that includes a second operation node in addition to the first operation node; and
apply the direct algorithm to the second path through the dispatcher node to yield the at least one solution path.
11. The system of claim 10 , wherein the modified graphical intermediate representation is in SSA format.
12. The system of claim 10 , wherein the instructions that when executed by the processing resource to cause the processing resource to modify the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation include instructions executable by the processing resource to:
reduce the solution set to yield a solution reduction tree.
13. The system of claim 12 , wherein the instructions that when executed by the processing resource to cause the processing resource to modify the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation further include instructions executable by the processing resource to:
extract paths from the solution reduction tree to yield a solution.
14. The system of claim 13 , wherein the instructions that when executed by the processing resource to cause the processing resource to modify the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation further include instructions executable by the processing resource to:
actualize the solution to yield an actualized solution corresponding to the branch of the graphical intermediate representation wherein the modified graphical intermediate representation includes the actualized solution.
15. The system of claim 10 , wherein the at least one algorithm includes a direct algorithm, and wherein the instructions that when executed by the processing resource to cause the processing resource to prove the branch behavior of the dispatcher node include instructions executable by the processing resource to:
determine that application of the direct algorithm to the work item failed to yield the solution path; and
apply a symbolic algorithm to the identified control flow problem to yield the solution set.
16. A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource of a computer system, causes the one or more processing resources to:
identify a dispatcher node in a graphical intermediate representation of an executable code;
identify at least one work item, wherein the at least one work item is a path through the dispatcher node and includes at least one operation node in addition to the dispatcher node;
prove a branch behavior of the dispatcher node, wherein proving the branch behavior includes applying at least one algorithm to the work item to yield at least one solution path, wherein the at least one solution path is included in a solution set; and
modify the graphical intermediate representation of the executable code to yield a modified graphical intermediate representation, and wherein the dispatcher node is eliminated from the modified graphical intermediate representation, wherein
the at least one operation node is a first operation node;
the path through the dispatcher node is a first path through the dispatcher node; and
the at least one algorithm is a direct algorithm, wherein
the instructions that when executed by the processing resource to cause the processing resource to prove the branch behavior of the dispatcher node includes instructions executable by the processing resource to:
determine that application of the direct algorithm to the work item fails to yield any solution path;
identify a second path through the dispatcher node that includes a second operation node in addition to the first operation node; and
apply the direct algorithm to the second path through the dispatcher node to yield the at least one solution path.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions that when executed by the processing resource to cause the processing resource to modify the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation include instructions executable by the processing resource to:
reduce the solution set to yield a solution reduction tree; and
extract paths from the solution reduction tree to yield a solution.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the instructions that when executed by the processing resource to cause the processing resource to modify the graphical intermediate representation of the executable code to yield the modified graphical intermediate representation further include instructions executable by the processing resource to:
actualize the solution to yield an actualized solution corresponding to the branch of the graphical intermediate representation wherein the modified graphical intermediate representation includes the actualized solution.