Quarkslab folks proposed a challenge: modify any compiler to generate code with some obfuscation but valid semantics. In other words, add some noise but keep the program logic valid.
Time to have some fun with C1: OpenJDK’s 1st tier JIT compiler.
Obfuscation “noise” can be added at different stages of the compilation process. Adding it early may be useful to target multiple architectures but it’s necessary to check if following optimization passes revert the effect.
The basic flow for C1 is the following: Java bytecodes -> IR (Intermediate Representation) -> LIR (Low-level Intermediate Representation) -> assembly code (architecture specific). A few key functions involved in these transformations: GraphBuilder::iterate_bytecodes_for_block (for IR generation), LIRGenerator::block_do (for LIR generation) and LIR_Assembler::emit_lir_list (for assembly generation).
This is my basic pseudo-random Java test code -don’t even try to make sense of it!-:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
public class Main { private static volatile int a; private static String s; public static void main(String[] args) { System.out.println("Jit example started"); int max_iterations = 15000; while(max_iterations-- > 0) { f(); } System.out.println("a (final): " + a); System.out.println("s (final): " + s); } private static void f() { int i = 100; while (i-- > 0) { a = a + 1234; } s = new Integer(a).toString(); } } |
Function Main::f is called many times in a loop so it will be compiled by C1 first.
This is Main::f in bytecodes:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
private static void f(); Code: 0: bipush 100 2: istore_0 3: iload_0 4: iinc 0, -1 7: ifle 23 10: getstatic #6 // Field a:I 13: sipush 1234 16: iadd 17: putstatic #6 // Field a:I 20: goto 3 23: new #10 // class java/lang/Integer 26: dup 27: getstatic #6 // Field a:I 30: invokespecial #11 // Method java/lang/Integer."<init>":(I)V 33: invokevirtual #12 // Method java/lang/Integer.toString:()Ljava/lang/String; 36: putstatic #8 // Field s:Ljava/lang/String; 39: return |
My obfuscation noise will be before any addition operation. In this case, before the iadd instruction.
This will be my x86_64 innocuous noise:
|
1 2 3 4 5 6 7 8 9 10 |
PUSHFD PUSH RAX PUSH RDX tryAgain: RDTSC CMP EAX, EDX JE tryAgain POP RDX POP RAX POPFD |
I’m saving the EFLAGS, RAX and RDX registers first because their values will be destroyed -restoring original values is mandatory to keep the state integrity after the obfuscation code-. Then I get the timestamp with RDTSC and compare the lower and higher halves. They will likely be different. In the unrealistic case that they are equal, we try again. Then we restore original values and continue execution as if nothing happened.
In x86_64, this is Main::f JIT compiled method:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
0x7f03f570c0c5: cmp $0x0,%esi 0x7f03f570c0c8: je 0x7f03f570c281 0x7f03f570c0ce: mov $0x64,%edx 0x7f03f570c0d3: jmpq 0x7f03f570c12f 0x7f03f570c0d8: movabs $0x6d9a02658,%rdx 0x7f03f570c0e2: mov 0x74(%rdx),%esi 0x7f03f570c0e5: pushfq 0x7f03f570c0e6: push %rax 0x7f03f570c0e7: push %rdx 0x7f03f570c0e8: rdtsc 0x7f03f570c0ea: cmp %edx,%eax 0x7f03f570c0ec: je 0x7f03f570c0e8 0x7f03f570c0ee: pop %rdx 0x7f03f570c0ef: pop %rax 0x7f03f570c0f0: popfq 0x7f03f570c0f1: add $0x4d2,%esi 0x7f03f570c0f7: mov %esi,0x74(%rdx) 0x7f03f570c0fa: lock addl $0x0,-0x40(%rsp) 0x7f03f570c100: movabs $0x7f03d5cfcc60,%rdx 0x7f03f570c10a: mov 0x24(%rdx),%esi 0x7f03f570c10d: add $0x8,%esi 0x7f03f570c110: mov %esi,0x24(%rdx) |
I then decided to add some unaligned jumps as an anti-disassembly technique. Main::f now looks a bit more obscure:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
0x7f4b64c52865: push %rax 0x7f4b64c52866: lea 0x5(%rip),%rax # 0x7f4b64c52872 0x7f4b64c5286d: jmpq *%rax 0x7f4b64c5286f: callq 0x7f4b66b0d32f 0x7f4b64c52874: callq 0x7f4b95d47b15 0x7f4b64c52879: jmp 0x7f4b64c5287c 0x7f4b64c5287b: callq 0x7f4b5c39eabb 0x7f4b64c52880: jmp 0x7f4b64c52883 0x7f4b64c52882: callq 0x7f4ae61dc5e1 0x7f4b64c52887: (bad) 0x7f4b64c52888: rolb %cl,(%rax,%rax,1) 0x7f4b64c5288b: add %cl,-0x7c0f8b8e(%rcx) 0x7f4b64c52891: rex.R and $0xc0,%al 0x7f4b64c52894: add %cl,-0x46(%rax) 0x7f4b64c52897: (bad) 0x7f4b64c52898: fmul %st(7),%st 0x7f4b64c5289a: xor 0x7f(%rbx),%ecx |
Download patch here (based on JDK rev 89111a0e6355).