# APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity
## 1 Introduction  
Windows applications rely on APIs to interact with the system and perform various functions, including network communication, file access, and message interaction. Understanding these APIs is crucial for comprehending program behavior. When direct reverse analysis is challenging, APIs serve as an indispensable reference for analysts to identify program behavior and intent [1]. To protect the API calling process, program developers often employ various obfuscation techniques to prevent detection. The basic premise of API call obfuscation is to use a more complex approach than the Windows API call process to make it difficult for analysts to identify which API has been called. However, over the past two decades, analysts have proposed a range of techniques to overcome API obfuscation. The key step in API deobfuscation is to associate the virtual memory address accessed by the program during runtime with the API name. Analysts typically employ program analysis methods such as symbolic execution or taint analysis to track program execution. This involves collecting call instructions and function addresses, and then correlating them with the loaded APIs in memory to identify any obfuscated APIs. The ability to collect address information related to known APIs during API calls is a critical factor in the ongoing game between obfuscation and deobfuscation techniques. Sections 2.1 and 2.2 of this paper systematically summarize existing API call obfuscation and deobfuscation techniques. The findings reveal that even the most advanced deobfuscation methods are still capable of collecting addresses associated with known APIs. As a result, none of the currently available API call obfuscation methods can effectively prevent analysts from conducting API deobfuscation. Therefore, the development of a more secure API call obfuscation scheme is a pressing concern. In this paper, we propose a new approach to API call obfuscation called API address space obscurity (APIASO), which aims to prevent analysts from accessing address information associated with known APIs during the API call process. APIASO protects the entire API call process by moving the API's critical internal functions into the user code space. When a program calls the API, it first executes the functions that have been moved into the user code space and then proceeds to execute the non-critical functions within the API. This prevents analysts from obtaining information directly related to the known API from the API call. Additionally, for the API code extraction process, our approach provides a wide range of alternative API name hash schemes by designing a hash function generator to achieve more secure API address resolution. The API name hash serves as a cryptographic key to move the key functions of the API to the user code space, making it impossible for analysts to access usable information from the process of API address resolution and function movement. We conducted extensive experiments to evaluate the effectiveness and obfuscation overhead of APIASO. To quantitatively assess the impact of APIASO on the API address space, we measured the obscurity degree of the API address space. We also tested the resistance of APIASO against four representative deobfuscation techniques. In addition, we demonstrated the availability and correctness of APIASO by developing an automated API call obfuscation system. The main contributions of this paper are:  
* We provide a comprehensive overview of existing API call obfuscation and deobfuscation techniques. We also discuss the limitations of current API obfuscation techniques and their inability to effectively counter advanced deobfuscation techniques. * We present API address space obscurity (APIASO), an API call obfuscation technique specifically designed for Windows applications.