QanDe: The Power of Binary Emulation for Obfuscation Analysis

Software developers often use code obfuscation to hide their software's intellectual features and keep critical data (such as cryptographic keys) secret, making detection and analysis difficult. This makes obfuscation a significant obstacle for security analysts in understanding complex logic. When such obfuscations are countered, they must be penetrated or removed (“deobfuscated”) to understand the code's internal logic and devise countermeasures. In this paper, we propose QanDe, an automated tool that introduces emulation and symbolic execution to simplify the obfuscation of binary code. Especially for a binary obfuscated by OLLVM (the most popular native code obfuscator), QanDe can recover the original Control Flow Graph and obtain the deobfuscated executable binary file. Our tool is designed to be practical and user-friendly, making it the first of its kind to introduce the power of binary emulation to level up analysis when dealing with obfuscation transformations.