True/False Opaque Predicates

Submitted by admin on Fri, 04/27/2018 - 15:08

To the selected basic block, an opaque predicate can be added. The following screenshot depicts the original basic block at the left side. Each instruction can be selected individually, so the user can point where he would like to insert an opaque predicate. In the middle of the window some predefined opaque predicates are listed, that can be selected. The right side of this window lists some actions a user can perform. The first one can be used to indicate what kind of opaque predicate has to be inserted; a false one or a true one. Some underlying functionality can transform the predicates to the chosen opaque predicate. Next, there is a test feature which will be discussed in the next paragraph. The information buttons in the lower right corner pop up detailed information on the predicates or the basic block when pressed.

For instance, the window at the right pops up when the button "Info opaque predicate" is pressed. This window first shows the user that inserting the opaque predicate $7y^2-1 != x^2$ will change the registers ebx, ecx and edx and will also affects all flags. Secondly, an assembly of the opaque predicate can be found; in our case in x86 instructions. Finally, the user finds the condition that is used to make a true opaque predicate.

The usage of the "Insert?"-button. A position in the basic block can be selected and an opaque predicate can be chosen. As an opaque predicate consumes some registers and most likely modifies the flags during the computation of the opaque predicate, it is possible with the "Insert?"-button to automatically check the inte grity of the function if the opaque predicate should be inserted at the chosen position. In the window on the left side, \textsc{Loco} checks if it is allowed to insert the opaque predicate $7y^2-1 != x^2$ after the selected mov-instruction. Inserting the opaque predicate will cause some problems because the register $\%ebx$ is live at the selected point in the program and the opaque predicate also uses that register. So inserting this opaque predicate at the selected point in the program is not a good idea. 

Next, a better position is chosen.
Clicking the $OK$-button will insert the opaque predicate at the given position.

The following screenshot shows the CFG after applying control flow flattening and an addition of an opaque predicate. This program can be written out and we will end up with an obfuscated program that is functional the same as the program we started with, but that is harder to understand.