# APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity
## 2 Background
### API Deobfuscation Techniques  
To improve the efficiency of an analysis, analysts perform API monitoring to obtain API call information for programs that implement API call obfuscation. Table 2 provides an overview of current API deobfuscation techniques. These techniques can be categorized into the following three groups based on their starting point: call site monitoring, position monitoring, and hybrid monitoring.  
Call site monitoring: Figure 2 depicts that the deobfuscation techniques for API call site monitoring follow two steps: (1) Instruction scanning (I in Figure 2), which runs PE files to find possible API call sites in memory, including indirect calls, direct calls, or indirect jumps. (2) Address association (II in Figure 2), which correlates the destination address of a possible call site with the exported API address of the loaded dynamic link library. The basic principle of call site monitoring is that the destination address of a jump instruction in memory is always found to be the address of the system-loaded API. As illustrated in Figure 1b,d, there are instructions in the memory space \"induction area\" in which the target address is the system load API address.  
Position monitoring: Position monitoring is the monitoring of system load DLL pages. The basic principle is that regardless of the API call obfuscation technique used, the program eventually executes the system load DLL area code. Position monitoring includes API hook monitoring and taint analysis association. API hook monitoring (III in Figure 2) monitors the execution of API code in the DLL. QuietRIATT and secure unpack use the API hook approach to set hooks in the loaded API code area, which is logged when the program calls the API where the hooks are set; alternatively, the taint analysis association [17; 18] (IV in Figure 2) method involves attaching taint tags to the API code, and when the program executes the code in the DLL space, the API executed is determined by the attached taint tags.  
Hybrid monitoring: The call site monitoring technique can monitor the call site of the whole program, but the call site address of the program applying API position obfuscation is a non-API-related address, which makes the call site monitoring invalid. The position monitoring approach can effectively prevent API position obfuscation, but it can only address a single path at a time and has low coverage. API-Xray and RePEconstruct have  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Classification** & **Citations** \\ \hline \multirow{4}{*}{Call site monitoring} & BinUnpack [7], SOK [8], \\  & Scylla [9], Eureka [10], \\  & RePEc [11], PinDemonium [12], \\  & Arancino [13], Arg Prediction [14] \\ \hline \multirow{2}{*}{Position monitoring} & API Chaser [15], QuietRIATT [16], \\  & Secure unpack [17], Taint-assisted [18] \\ \hline Hybrid monitoring & API-Xray [4], RePEconstruct [19] \\ \hline \hline \end{tabular}
\end{table}
Table 2: Classification of API deobfuscation techniques.  
taken the benefits of both call site monitoring and position monitoring methods into account. They propose a hybrid monitoring approach that combines both techniques to enhance the efficiency of deobfuscation.