Posing New Challenges to Function Entry Identification Through Fine-Grained CFI Obfuscation

Function entry identification is a crucial yet challenging task for binary disassemblers that has been the focus of research in thepast decades. However, recent researches show that call frame information (CFI) provides accurate and almost complete functionentries. With the aid of CFI, disassemblers have significant improvements in function entry detection. CFI is specifically designed forefficient stack unwinding, and every function has corresponding CFI in x64 and aarch64 architectures. Nevertheless, not every functionand instruction unwinds the stack at runtime, and this observation has led to the development of techniques such as obfuscation tocomplicate function detection by disassemblers. We propose a prototype of ocfi to obfuscate CFI based on this observation. The goal of ocfi is to obstruct function detectionof popular disassemblers that use CFI as a way to detect function entries. We evaluated ocfi on a large-scale dataset that includesreal-world applications and automated generation programs, and found that the obfuscated CFI was able to correctly unwind thestack and made the detection of function entries of popular disassemblers more difficult. Furthermore, on average, ocfi incurs a sizeoverhead of only 5% and nearly zero runtime overhead.