Symbolic execution of obfuscated code

Babak Yadegari, Saumya Debray

Research output: Chapter in Book/Report/Conference proceedingConference contribution

65 Scopus citations


Symbolic and concolic execution find important applications in a number of security-related program analyses, including analysis of malicious code. However, malicious code tend to very often be obfuscated, and current concolic analysis techniques have trouble dealing with some of these obfuscations, leading to imprecision and/or excessive resource usage. This paper discusses three such obfuscations: two of these are already found in obfuscation tools used by malware, while the third is a simple variation on an existing obfuscation technique. We show empirically that existing symbolic analyses are not robust against such obfuscations, and propose ways in which the problems can be mitigated using a combination of fine-grained bit-level taint analysis and architecture-aware constraint generations. Experimental results indicate that our approach is effective in allowing symbolic and concolic execution to handle such obfuscations.

Original languageEnglish (US)
Title of host publicationCCS 2015 - Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security
PublisherAssociation for Computing Machinery
Number of pages13
ISBN (Electronic)9781450338325
StatePublished - Oct 12 2015
Externally publishedYes
Event22nd ACM SIGSAC Conference on Computer and Communications Security, CCS 2015 - Denver, United States
Duration: Oct 12 2015Oct 16 2015

Publication series

NameProceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)1543-7221


Other22nd ACM SIGSAC Conference on Computer and Communications Security, CCS 2015
Country/TerritoryUnited States


  • Obfuscation
  • Reverse engineering
  • Symbolic execution
  • Taint analysis

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications


Dive into the research topics of 'Symbolic execution of obfuscated code'. Together they form a unique fingerprint.

Cite this