title: ÐÐ±ÑÑÑÐºÐ°ÑÐ¾Ñ Ð±Ð¸Ð½Ð°ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² ÑÐ¾ÑÐ¼Ð°ÑÐ° Portable Executable
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Obfuscator for Portable Executable binary files
Creators: name: ÐÑÑÐ¸ÐµÐ², ÐÐµÐ¾ÑÐ³Ð¸Ð¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¸Ñ
Ð·Ð°ÑÐ¸ÑÐ° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ
Ð±Ð¸Ð½Ð°ÑÐ½ÑÐ¹ ÐºÐ¾Ð´
Portable Executable
Ð²Ð¸ÑÑÑÐ°Ð»ÑÐ½ÑÐµ Ð¼Ð°ÑÐ¸Ð½Ñ
Ð¿ÑÐ¾ÑÐµÐºÑÐ¾ÑÑ
obfuscation
software protection
binary code
virtual machines
protectors

description: Ð¦ÐµÐ»ÑÑ Ð´Ð°Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¾ÑÐ°, ÐºÐ¾ÑÐ¾ÑÑÐ¹ Ð¿Ð¾Ð·Ð²Ð¾Ð»Ð¸Ñ Ð·Ð°ÑÑÑÐ´Ð½Ð¸ÑÑ Ð°Ð½Ð°Ð»Ð¸Ð· Ð¸ Ð¼Ð¾Ð´Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ñ Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð². ÐÐ»Ñ Ð´Ð¾ÑÑÐ¸Ð¶ÐµÐ½Ð¸Ñ ÑÑÐ¾Ð¹ ÑÐµÐ»Ð¸ Ð±ÑÐ»Ð¸ Ð¿Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½Ñ ÑÐ»ÐµÐ´ÑÑÑÐ¸Ðµ Ð·Ð°Ð´Ð°ÑÐ¸: Â  Â  1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¸Ð¸, ÑÐ°ÐºÐ¸Ñ ÐºÐ°Ðº ÑÐ¸ÑÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐ¾Ðº Ð¸ ÐºÐ¾Ð½ÑÑÐ°Ð½Ñ, Ð²ÑÑÑÐ°Ð¸Ð²Ð°Ð½Ð¸Ðµ Ð»Ð¾Ð¶Ð½ÑÑ Ð¸Ð½ÑÑÑÑÐºÑÐ¸Ð¹, ÑÐ»Ð¸ÑÐ½Ð¸Ðµ Ð¸ ÑÐ°Ð·Ð´ÐµÐ»ÐµÐ½Ð¸Ðµ ÑÑÐ½ÐºÑÐ¸Ð¹, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð²Ð¸ÑÑÑÐ°Ð»ÑÐ½ÑÑ Ð¼Ð°ÑÐ¸Ð½, Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¸Ñ ÑÐ¿ÑÐ°Ð²Ð»ÑÑÑÐ¸Ñ ÑÑÑÑÐºÑÑÑ Ð¸ Ð²ÑÐ·Ð¾Ð²Ð¾Ð² ÑÑÐ½ÐºÑÐ¸Ð¹, Ð¿Ð¾Ð»Ð¸Ð¼Ð¾ÑÑÐ¸Ð·Ð¼ Ð¸ Ð¼ÐµÑÐ°Ð¼Ð¾ÑÑÐ¸Ð·Ð¼. Â  Â  2. ÐÐ½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐµÑÐµÐ½Ð¸Ð¹, ÑÐ°ÐºÐ¸Ñ ÐºÐ°Ðº VMProtect, Alcatraz, PE bin2bin obfuscator Ð¸ Viper, Ñ ÑÐµÐ»ÑÑ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ñ Ð¿ÑÐµÐ¸Ð¼ÑÑÐµÑÑÐ² Ð¸ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¾Ð². Â  Â  3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¾ÑÐ° Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼ÐµÑÐ°Ð¼Ð¾ÑÑÐ¸Ð·Ð¼Ð°, Ð´Ð¾Ð±Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð±ÐµÑÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¾Ð³Ð¾ ÐºÐ¾Ð´Ð° Ð¸ ÑÐ¿Ð°ÐºÐ¾Ð²ÐºÐ¸. Â  Â  4. ÐÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¾ÑÐ° Ð½Ð° Ð¿ÑÐµÐ´Ð¼ÐµÑ ÐµÐ³Ð¾ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¸ Ð²Ð»Ð¸ÑÐ½Ð¸Ñ Ð½Ð° Ð¿ÑÐ¾Ð¸Ð·Ð²Ð¾Ð´Ð¸ÑÐµÐ»ÑÐ½Ð¾ÑÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ. Ð ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð±ÑÐ»Ð¾ ÑÑÑÐ°Ð½Ð¾Ð²Ð»ÐµÐ½Ð¾, ÑÑÐ¾ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¸Ð¸ Ð¿Ð¾Ð²ÑÑÐ°ÑÑ Ð·Ð°ÑÐ¸ÑÑ ÐÐ, ÑÑÐ»Ð¾Ð¶Ð½ÑÑ ÐµÐ³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð· Ð¸ Ð¾Ð±ÑÐ°ÑÐ½ÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÑ. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½ÑÐ¹ Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¾Ñ ÑÑÐ¿ÐµÑÐ½Ð¾ ÑÐµÐ°Ð»Ð¸Ð·ÑÐµÑ Ð½ÐµÑÐºÐ¾Ð»ÑÐºÐ¾ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¸Ð¸, Ð¾Ð±ÐµÑÐ¿ÐµÑÐ¸Ð²Ð°Ñ Ð·Ð°ÑÐ¸ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð¿ÑÐ¸ Ð¼Ð¸Ð½Ð¸Ð¼Ð°Ð»ÑÐ½Ð¾Ð¼ Ð²Ð»Ð¸ÑÐ½Ð¸Ð¸ Ð½Ð° Ð¿ÑÐ¾Ð¸Ð·Ð²Ð¾Ð´Ð¸ÑÐµÐ»ÑÐ½Ð¾ÑÑÑ. ÐÑÐ¿ÑÑÐ°Ð½Ð¸Ñ Ð¿Ð¾Ð´ÑÐ²ÐµÑÐ´Ð¸Ð»Ð¸, ÑÑÐ¾ Ð¾Ð±ÑÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÐµ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ñ Ð¿Ð¾ÐºÐ°Ð·ÑÐ²Ð°ÑÑ ÑÐ¼ÐµÑÐµÐ½Ð½Ð¾Ðµ ÑÐ²ÐµÐ»Ð¸ÑÐµÐ½Ð¸Ðµ Ð¾Ð±ÑÐµÐ¼Ð° Ð¿Ð°Ð¼ÑÑÐ¸ Ð¸ Ð½ÐµÐ·Ð½Ð°ÑÐ¸ÑÐµÐ»ÑÐ½Ð¾Ðµ ÑÐ½Ð¸Ð¶ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¾Ð¸Ð·Ð²Ð¾Ð´Ð¸ÑÐµÐ»ÑÐ½Ð¾ÑÑÐ¸. ÐÑÐ°ÐºÑÐ¸ÑÐµÑÐºÐ°Ñ Ð·Ð½Ð°ÑÐ¸Ð¼Ð¾ÑÑÑ ÑÐ°Ð±Ð¾ÑÑ Ð·Ð°ÐºÐ»ÑÑÐ°ÐµÑÑÑ Ð² ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ð¸ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð° Ð´Ð»Ñ Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¸Ð¸ Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² ÑÐ¾ÑÐ¼Ð°ÑÐ° PE, ÐºÐ¾ÑÐ¾ÑÐ¾Ðµ Ð¼Ð¾Ð¶ÐµÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¾ Ð´Ð»Ñ Ð·Ð°ÑÐ¸ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð¾Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¸ Ð¼Ð¾Ð´Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½ÑÐ¹ Ð¾Ð±ÑÑÑÐºÐ°ÑÐ¾Ñ Ð¼Ð¾Ð¶ÐµÑ Ð½Ð°Ð¹ÑÐ¸ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ Ð² ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÑ Ð¾Ð±Ð»Ð°ÑÑÑÑ, ÑÑÐµÐ±ÑÑÑÐ¸Ñ Ð·Ð°ÑÐ¸ÑÑ ÐºÐ¾Ð´Ð°, Ð²ÐºÐ»ÑÑÐ°Ñ ÐºÐ¾Ð¼Ð¼ÐµÑÑÐµÑÐºÐ¸Ðµ Ð¸ ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½ÑÐµ Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ñ.
description: The subject of the graduate qualification work is the development of an efficient obfuscator that complicates the analysis and modification of executable files. To achieve this goal, the following tasks were set: Â  Â  1. Research Modern Obfuscation Methods. This includes string and constant encryption, embedding false instructions, function merging and splitting, using virtual machines, obfuscating control structures and function calls, polymorphism, and metamorphism. Â  Â  2. Analyze Existing Solutions. Investigate solutions such as VMProtect, Alcatraz, PE bin2bin obfuscator, and Viper to identify their advantages and disadvantages. Â  Â  3. Develop an Obfuscator. Utilize methods like metamorphism, adding meaningless code, and packing. Â  Â  4. Evaluate the Developed Obfuscator. Assess its effectiveness and impact on software performance. The study established that modern obfuscation methods significantly enhance software protection by complicating its analysis and reverse engineering. The developed obfuscator successfully implements several obfuscation methods, providing protection for executable files with minimal impact on their performance. Tests demonstrated that obfuscated versions of programs show moderate memory usage increase and slight performance degradation, confirming the effectiveness of the selected methods. The practical significance of this work lies in the creation of a software tool for obfuscating PE format executable files, which can be used to protect software from analysis and modification. The developed obfuscator can be applied in various fields requiring code protection, including commercial and corporate applications.