Obfuscation of executable code to improve resistance to static disassembly

A great deal of software is distributed in the form of executable code. The ability to reverse engineer such executables can create opportunities for theft of intel-lectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabil-ities in an application. The process of reverse engi-neering an executable program typically begins with disassembly, which translates machine code to assem-bly code. This is then followed by various decompila-tion steps that aim to recover higher-level abstractions from the assembly code. Most of the work to date on code obfuscation has focused on disrupting or confus-ing the decompilation phase. This paper, by contrast, focuses on the initial disassembly phase. Our goal is to disrupt the static disassembly process so as to make programs harder to disassemble correctly. We describe two widely used static disassembly algorithms, and discuss techniques to thwart each of them. Experimen-tal results indicate that significant portions of executa-bles that have been obfuscated using our techniques are disassembled incorrectly, thereby showing the ef-ficacy of our methods.