CRII: SaTC: Simplification of Mixed Boolean-Arithmetic Obfuscated Expression

软件混淆是一种转换过程，它使程序难以理解，但仍然保留程序的所有原始行为。混合布尔算法（MBA）混淆是一种强大而高效的混淆方法。它通过混合布尔运算符和算术运算符将简单的计算转换为非常复杂的表达式。由于许多恶意软件开发人员采用混淆技术来隐藏恶意软件，因此分析混淆程序在现代软件安全中起着至关重要的作用。本项目寻求有效地逆转MBA混淆结果，即从MBA转换产生的混淆程序中恢复原来的程序逻辑。该项目的目的是揭示MBA混淆的理论和实践属性。本研究揭示了MBA混淆未被发现的根本弱点，从而对现有的MBA混淆设计提出了挑战。研究任务包括：1)开发一种基于算法的简化方法来逆转正常的MBA混淆；2)简化多粒度MBA混淆；3)减少通用的非线性MBA表达式。该项目将提高人类对MBA去混淆的认识，并产生实用的MBA反向分析工具。该项目将在安全分析应用程序中更广泛地采用形式化方法，并激发更多跨编程语言和软件安全的跨学科研究。开发的方法和数据集将向公众开放。此外，该项目将促进新型教育工具的开发，以加强新罕布什尔大学（UNH）目前的几门课程。少数民族学生和服务不足的人群将参与研究和课外活动（如夺旗比赛），参与尖端的网络安全研究。源代码、文档、实验结果和学术出版物将使用分布式版本控制系统Git进行管理。新教材将由香港大学课程管理系统编排。本地存储库副本将存储在UNH SoftSec Group的备份服务器中。数据将保留至少三年以上的奖励期。学术出版物、演讲和开源代码将在主页（https://www.cs.unh.edu/~dxu）.This)上提供，该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

Software obfuscation is a transformation procedure to make a program difficult to understand, but still preserves all of the program's original behavior. Mixed-Boolean-Arithmetic (MBA) obfuscation is a powerful and efficient obfuscation method. It transforms simple calculations to very complex expressions with mixed Boolean and arithmetic operators. Since many malware developers have adopted obfuscation techniques to hide malware from detection, analyzing obfuscated programs plays a crucial role in modern software security. This project seeks to effectively reverse MBA obfuscation result, which means to recover the original program logic from an obfuscated program produced by MBA transformation.The objective of this project is to unveil the theoretical and practical attributes of MBA obfuscation. This research reveals the undiscovered fundamental weakness of MBA obfuscation and consequently challenges the existing design of MBA obfuscation. The research tasks include: 1) developing an arithmetic-based simplification method to reverse normal MBA obfuscation; 2) simplifying multi-granularity MBA obfuscation; and 3) reducing generic non-linear MBA expression. This project will advance human knowledge about MBA de-obfuscation and produce practical MBA reverse analysis tools.The project will enable broader adoption of formal methods in security analysis applications and inspire more interdisciplinary research across programming languages and software security. The developed methods and data set will be publicly available. Besides, this project will facilitate the development of novel educational tools to enhance several current courses at The University of New Hampshire (UNH). The minority students and under-served populations will be engaged in both research and extracurricular activities (such as Capture-the-Flag competition) to participate in cutting-edge cyber-security research.Source code, documentation, experimental results, and scholarly publications, will be managed using the distributed version control system Git. New curriculum materials will be organized by the course management system at UNH. A local repository copy will be stored in the backup servers at UNH SoftSec Group. Data will be retained for at least three years beyond the award period. The scholarly publications, presentations, and open-source code will be available on the homepage (https://www.cs.unh.edu/~dxu).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.