Polaris: MIR-Level Obfuscation in LLVM for Efficient and Robust Decompiler Resistance
High-level software obfuscation (e.g., source code, LLVM IR) typically leaves recognizable artifacts that modern decompilers can exploit, while binary-level techniques (e.g., virtualization) impose large overheads and still expose recoverable patterns. Machine IR (MIR), whcih serves as the representation after instruction selection in the LLVM backend, enables target-aware, fine-grained transformations applied before final code emission without violating compiler guarantees. In this work, we present Polaris, an LLVM-integrated MIR-level obfuscation framework that applies composable transformations including function-boundary perturbation, control-flow restructuring, and data-flow noise injection to degrade function recovery and pseudocode quality produced by mainstream reverse-engineering tools, while preserving semantics. We evaluate Polaris on 100 complex programs comprising 169K LoC and 4,024 functions, comparing it against state-of-the-art decompilers including IDA, Ghidra, and Binary Ninja. Polaris substantially reduces the number of correctly recovered functions, increases fragmentation, degrades pseudocode quality, and raises analysis timeouts, all while incurring only practical runtime overheads. Our implementation and demo video are available at https://github.com/za233/Polaris-Obfuscator and https://youtu.be/eALCDiEqJJw respectively.
Wed 15 AprDisplayed time zone: Brasilia, Distrito Federal, Brazil change
16:00 - 17:30 | Dependability and Security 3Research Track / Demonstrations at Oceania X Chair(s): Lars Grunske Humboldt-Universität zu Berlin | ||
16:00 15mTalk | Polaris: MIR-Level Obfuscation in LLVM for Efficient and Robust Decompiler Resistance Demonstrations Zhou Ang , Jiongchi Yu Singapore Management University, Yiran Zhang , Ziming Zhao Zhejiang University, Zhaoxuan Li Institute of Information Engineering, Chinese Academy of Sciences;School of Cyber Security, University of Chinese Academy of Sciences, Tingting Li Zhejiang University | ||
16:15 15mTalk | AnchorDiff: Binary OSS Version Identification Method Based on Anchor Node Slicing Research Track Zixuan Liang National University of Defense Technology, Lei Zhou National University of Defense Technology, Yongqiang Guo National University of Defense Technology, Peihong Lin National University of Defense Technology, Danjun Liu National University of Defense Technology, Baosheng Wang National University of Defense Technology, Xu Zhou National University of Defense Technology Media Attached | ||
16:30 15mTalk | One Size Does Fit All: Kernel-Assisted Fine-Grained Debloating and Layout Randomization for Shared Libraries Research Track | ||
16:45 15mTalk | Beyond Fuzzy Matching: Constraint-Guided Patch Presence Testing for Obfuscated Java Binaries Research Track Lige Zhan Wuhan University, Jiang Ming Tulane University, USA, Chenke Luo Tulane University, Letian Sha Nanjing University of Posts and Telecommunications, Guojun Peng Wuhan University, Jianming Fu Wuhan University | ||
17:00 15mTalk | Fast Flow-Sensitive C Program Partitioning via Iterative Value-Flow Refinement Research Track | ||
17:15 15mTalk | An Empirical Study on the Robustness of Android Third-Party Library Detection Tools Against Advanced Obfuscation Research Track Dahan Pan Shanghai Jiao Tong University, Zhuohao Zhang GoSec Research Group, Yunjia Min Shanghai Jiao Tong University, Runhan Feng Purple Mountain Laboratories, Yuanyuan Zhang Shanghai Jiao Tong University | ||