# APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity
## 3 API Address Space obscurity Model
### API Name Clue Obfuscation
Since only the API name hashes in the specified DLL import table need to be satisfied without collisions, this process greatly reduces the search space of the algorithm. The implementation of the above algorithm assigns a unique hash function to each API name, increasing the resistance of the API name resolution process to reverse analysis. The API address space obscurity algorithm is shown in Algorithm 1. The inputs to the algorithm are the program P, the DLL address space \(DASpace\), and the obfuscation threshold \(\varepsilon\), where \(\varepsilon\) represents the set criteria for the moved low-level function. ```
0:Program \(P\), \(DASpace\), _Obfuscation threshold_: \(\varepsilon\)
0:\(o(P)\) denotes the obfuscated program
1. Define the obfuscated API call graph: \(\text{OG}_{API_{i}}=\{OF_{API_{i}},OE_{API_{i}}\}\)
2. procedure CallSpaceObj (\(AASpace_{API_{i}}\),\(\varepsilon\)):
3. \(\text{OG}_{API_{i}}=\text{G}_{API_{i}}-\text{G}_{API_{i}}\cap\text{G}_{DLL}\) // Prune all common function nodes
4. foreach \(f_{q}\) in \(F_{API_{i}}\):
5. iflevel (\(f_{q}\)) \(\leq\)\(\varepsilon\)and \(f_{q}\
otin\text{OF}_{API_{i}}\):
6. \(\text{OF}_{API_{i}}=\text{OF}_{API_{i}}+f_{q}\)
7. if\(f_{q}\in\text{SpecialFunc}\)and \(f_{q}\
otin\text{OF}_{API_{i}}\):
8. \(\text{OF}_{API_{i}}=\text{OF}_{API_{i}}+f_{q}\)
9. k = 0
10. do
11. foreach \(f_{q}\) in \(F_{DLL}\):
12. iflevel (\(f_{q}\)) \(\leq\)\(\varepsilon\)and \(f_{q}\
otin\text{F}_{API_{i}}\):
13. \(\text{OF}_{API_{i}}=\text{OF}_{API_{i}}+f_{q}\)
14. k++
15. while(k \(\leq\)\(\varepsilon\))
16. foreach \(f_{q}\) in \(\text{OF}_{API_{i}}\):
17. if\(\exists\)\(p\)\(p\)\(p=1\)and \(f_{p}\in API_{Internal}\):
18. \(\text{OF}_{API_{i}}=\text{OF}_{API_{i}}+f_{p}\)
19. Return \(\text{OG}_{API_{i}}\)
20. end procedure
21 // Algorithm Entry
22. Get the API collection for program P: \(\text{API}\)Set \(=\{\text{API}_{1},\ldots,\text{API}_{k}\}\)
23. HashSet \(=\{\text{hash}_{1},\ldots,\text{hash}_{n}\}\) \(\longleftarrow\)NameClueObj (APISet) // API name clue obfuscation
24 foreach \(\text{API}_{1}\) in APISet:
25. Get the address space corresponding to \(\text{API}_{i}\): \(AASpace_{API_{i}}\)
26. \(OG_{API_{i}}=\{OF_{API_{i}},OE_{API_{i}}\}\) \(\longleftarrow\)CallSpaceObj (\(AASpace_{API_{i}}\),\(\varepsilon\))
27. Choose a random hash function \(\text{hash}_{i}\) for \(\text{API}_{i}\)
28. Calculate the corresponding hash value: \(\text{hash}_{i}(\text{API}_{i})\)
29. Record Triads: \(<\)OG\({}_{API_{i}}\),\(\text{hash}_{i}\),\(\text{hash}_{i}(\text{API}_{i})\)>
30. Return \(o(P)\)
```  
**Algorithm 1**Address Space Obscurity Algorithm  
The API collection of the program is first extracted, and API name trail obfuscation is performed to generate a collection of hash functions (22-23). Then, the API collection is traversed, and API call space obfuscation is performed for each API (24-26). First, the call space obfuscation process prunes low-level function nodes and restores special function nodes (2-8); second, it adds bogus low-level function nodes (9-13); then adds function nodes on the call path according to the API internal function move requisites (14-18); and finally returns the obfuscated API internal call graph. After performing call space obfuscation, a unique hash function is assigned to each API, and the obfuscated call graph, hash function, and name hash triads (27-29) are kept in the program, thus completing the obfuscation process. After obfuscation, when the program executes the API call, it parses the API according to the triads and uses the saved hash to encrypt the mobile function to the user space for a more secure API call process.