CRII: SaTC: Simplification of Mixed Boolean-Arithmetic Obfuscated Expression

软件混淆是一种使程序难以理解的转换过程，但仍保留程序的所有原始行为。混合布尔算术 (MBA) 混淆是一种强大且高效的混淆方法。它将简单的计算转换为具有混合布尔和算术运算符的非常复杂的表达式。由于许多恶意软件开发人员采用混淆技术来隐藏恶意软件以使其不被检测到，因此分析混淆的程序在现代软件安全中起着至关重要的作用。该项目旨在有效地反转MBA混淆结果，即从MBA转换产生的混淆程序中恢复原始程序逻辑。该项目的目标是揭示MBA混淆的理论和实践属性。这项研究揭示了 MBA 混淆未被发现的根本弱点，从而挑战了 MBA 混淆的现有设计。研究任务包括：1）开发一种基于算术的简化方法来扭转正常的MBA混淆； 2）简化多粒度MBA混淆； 3) 减少通用的非线性 MBA 表达。该项目将增进人类对 MBA 反混淆的了解，并产生实用的 MBA 逆向分析工具。该项目将使安全分析应用中更广泛地采用形式化方法，并激发更多跨编程语言和软件安全的跨学科研究。开发的方法和数据集将公开。此外，该项目将促进新型教育工具的开发，以增强新罕布什尔大学（UNH）当前的几门课程。少数族裔学生和服务不足的人群将同时从事研究和课外活动（如夺旗比赛），参与前沿的网络安全研究。源代码、文档、实验结果和学术出版物将使用分布式版本控制系统 Git 进行管理。新的课程材料将由新罕布什尔大学的课程管理系统组织。本地存储库副本将存储在 UNH SoftSec Group 的备份服务器中。数据将在奖励期结束后保留​​至少三年。学术出版物、演示文稿和开源代码将在主页 (https://www.cs.unh.edu/~dxu) 上提供。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

Software obfuscation is a transformation procedure to make a program difficult to understand, but still preserves all of the program's original behavior. Mixed-Boolean-Arithmetic (MBA) obfuscation is a powerful and efficient obfuscation method. It transforms simple calculations to very complex expressions with mixed Boolean and arithmetic operators. Since many malware developers have adopted obfuscation techniques to hide malware from detection, analyzing obfuscated programs plays a crucial role in modern software security. This project seeks to effectively reverse MBA obfuscation result, which means to recover the original program logic from an obfuscated program produced by MBA transformation.The objective of this project is to unveil the theoretical and practical attributes of MBA obfuscation. This research reveals the undiscovered fundamental weakness of MBA obfuscation and consequently challenges the existing design of MBA obfuscation. The research tasks include: 1) developing an arithmetic-based simplification method to reverse normal MBA obfuscation; 2) simplifying multi-granularity MBA obfuscation; and 3) reducing generic non-linear MBA expression. This project will advance human knowledge about MBA de-obfuscation and produce practical MBA reverse analysis tools.The project will enable broader adoption of formal methods in security analysis applications and inspire more interdisciplinary research across programming languages and software security. The developed methods and data set will be publicly available. Besides, this project will facilitate the development of novel educational tools to enhance several current courses at The University of New Hampshire (UNH). The minority students and under-served populations will be engaged in both research and extracurricular activities (such as Capture-the-Flag competition) to participate in cutting-edge cyber-security research.Source code, documentation, experimental results, and scholarly publications, will be managed using the distributed version control system Git. New curriculum materials will be organized by the course management system at UNH. A local repository copy will be stored in the backup servers at UNH SoftSec Group. Data will be retained for at least three years beyond the award period. The scholarly publications, presentations, and open-source code will be available on the homepage (https://www.cs.unh.edu/~dxu).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.