基于3SAT的API调用迷惑方法

现有的API调用迷惑技术通用性不强，且容易被静态分析方法识破。为此，提出一种二进制代码迷惑方法，利用3SAT非透明常量，将API调用的目标地址变换为间接地址，使分析API地址成为NP完全问题，从而无法通过静态分析获取API地址。实验结果表明，该方法增加了代码分析的难度，可使基于API调用的静态分析检测方法失效。

API-calling Obfuscation Method Based on 3SAT

There are some shortages of existing API-calling obfuscation technology in the fight against the static analysis,such as weak versatility,easy to analyze and so on.This paper proposes a binary code obfuscation method.By using opaque constants based on 3SAT,it builds obfuscation transformations that change the objective address of API-calling to indirect and ensure the address invariable,which makes analyzing API address be an Nondeterministic Polynomial(NP) complete problem,so that the address can not be obtained by static analysis.Experimental results show that the difficulty of analysis of obfuscated program is enhanced,and the method can evade the static detection method based on API-calling.