# Loki: Hardening Code Obfuscation Against Automated Attacks

**Authors:** Moritz Schloegel, Tim Blazytko, Moritz Contag, Cornelius Aschermann, Julius Basler, Thorsten Holz, Ali Abbasi  
**arXiv:** [2106.08913](https://arxiv.org/abs/2106.08913)  
**Date:** 2021-06-16  
**Summary page:** https://www.summarizepaper.com/en/paper/2106.08913v1/

## Key points

- Protecting intellectual property is crucial in software obfuscation
- Existing techniques are vulnerable to automated deobfuscation attacks such as symbolic execution, taint analysis, and program synthesis
- Traditional methods focus on a single attack vector, leaving room for attackers to exploit other techniques like program synthesis
- Loki is designed to be resilient against all known automated deobfuscation attacks by deploying multiple techniques
- Includes a generic algorithm for synthesizing formally verified expressions of arbitrary complexity
- Offers diverse and difficult-to-pattern-match expressions, making it challenging for attackers to simplify the obfuscated code
- Reduces the success rate of program synthesis attacks to just 19%
- Loki incurs significantly less overhead while providing robust defense mechanisms against both static and dynamic automated deobfuscation attacks
- Introduces modern testing techniques like formal verification and fuzzing to ensure correctness of complex obfuscation transformations
- Represents a significant advancement in code obfuscation technology with high diversity and resilience against various attack vectors, including those based on program synthesis

## Summary

, , , , 

In the realm of software obfuscation, protecting intellectual property is paramount. However, existing commercial and academic techniques are vulnerable to automated deobfuscation attacks such as symbolic execution, taint analysis, and program synthesis. Some enhanced techniques have been proposed to counter these attacks, but they often come with high runtime overhead or can be circumvented by compiler optimizations. These approaches typically focus on a single attack vector, leaving room for attackers to exploit other more effective techniques like program synthesis. In response to these challenges, a new approach called Loki has been developed. Loki is designed to be resilient against all known automated deobfuscation attacks by deploying multiple techniques, including a generic algorithm for synthesizing formally verified expressions of arbitrary complexity. Unlike traditional methods that rely on a limited set of hardcoded rules, Loki's expressions are diverse and difficult to pattern match against. This diversity makes it challenging for attackers to simplify the obfuscated code statically or dynamically. One key aspect of Loki is its protection against previously unaccounted attack vectors such as program synthesis. By reducing the success rate of program synthesis attacks to just 19%, Loki offers a much stronger level of protection compared to existing methods. Additionally, Loki incurs significantly less overhead while providing robust defense mechanisms against both static and dynamic automated deobfuscation attacks. Furthermore, the design of Loki introduces modern testing techniques like formal verification and fuzzing to ensure the correctness of complex obfuscation transformations. By offering high diversity and resilience against various attack vectors, including those based on program synthesis, Loki represents a significant advancement in code obfuscation technology. Overall, Loki's innovative approach marks a substantial improvement over current state-of-the-art obfuscation schemes by providing enhanced protection levels with reduced overhead. The publication also includes the release of source code and evaluation artifacts for further research and development in this field.