{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,22]],"date-time":"2026-03-22T08:24:06Z","timestamp":1774167846905,"version":"3.50.1"},"reference-count":73,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2025,3,19]],"date-time":"2025-03-19T00:00:00Z","timestamp":1742342400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"CAS Project for Young Scientists in Basic Research","award":["YSBR-118"],"award-info":[{"award-number":["YSBR-118"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Archit. Code Optim."],"published-print":{"date-parts":[[2025,3,31]]},"abstract":"<jats:p>\n            Software obfuscation techniques have lost their effectiveness due to the rapid development of binary diffing techniques, which can achieve accurate function matching and identification. In this paper, we propose a new inter-procedural code obfuscation mechanism\n            <jats:sc>KHaos<\/jats:sc>\n            ,\n            <jats:xref ref-type=\"fn\">\n              <jats:sup>1<\/jats:sup>\n            <\/jats:xref>\n            which moves the code across functions to obfuscate the function by using compilation optimizations. Three obfuscation primitives are proposed to separate, aggregate, and hide the function. They can be combined to enhance the obfuscation effect further. This article also reveals distinguishing factors on obfuscation and compiler optimization and presents novel observations to gain insights into the impact of actively utilizing compiler optimization in obfuscation. A prototype of\n            <jats:sc>KHaos<\/jats:sc>\n            is implemented and evaluated on a large number of real-world programs. Experimental results show that\n            <jats:sc>KHaos<\/jats:sc>\n            outperforms existing code obfuscations and can significantly reduce the accuracy rates of six state-of-the-art binary diffing techniques with lower runtime overhead.\n          <\/jats:p>","DOI":"10.1145\/3701992","type":"journal-article","created":{"date-parts":[[2024,10,28]],"date-time":"2024-10-28T09:49:32Z","timestamp":1730108972000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["Shining Light on the Inter-procedural Code Obfuscation: Keep Pace with Progress in Binary Diffing"],"prefix":"10.1145","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9421-0380","authenticated-orcid":false,"given":"Peihua","family":"Zhang","sequence":"first","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing, China and WeChat, Tencent, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1777-8110","authenticated-orcid":false,"given":"Chenggang","family":"Wu","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China, University of the Chinese Academy of Sciences, Beijing, China, and Zhongguancun Laboratory, Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-6253-9106","authenticated-orcid":false,"given":"Hanzhi","family":"Hu","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China and University of the Chinese Academy of Sciences, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-4974-6446","authenticated-orcid":false,"given":"Lichen","family":"Jia","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0640-3997","authenticated-orcid":false,"given":"Mingfan","family":"Peng","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China and University of the Chinese Academy of Sciences, Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7003-1257","authenticated-orcid":false,"given":"Jiali","family":"Xu","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8511-1118","authenticated-orcid":false,"given":"Mengyao","family":"Xie","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5885-0858","authenticated-orcid":false,"given":"Yuanming","family":"Lai","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China and University of the Chinese Academy of Sciences, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3439-551X","authenticated-orcid":false,"given":"Yan","family":"Kang","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China and University of the Chinese Academy of Sciences, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4719-1804","authenticated-orcid":false,"given":"Zhe","family":"Wang","sequence":"additional","affiliation":[{"name":"SKLP, Institute of Computing Technology Chinese Academy of Sciences, Beijing China, University of the Chinese Academy of Sciences, Beijing China and Zhongguancun Laboratory, Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,3,19]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.diin.2015.01.011"},{"key":"e_1_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3175492"},{"key":"e_1_3_2_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/2991079.2991114"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/2430553.2430557"},{"key":"e_1_3_2_7_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-30222-5_10"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3624744"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2950350"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420997"},{"key":"e_1_3_2_11_2","volume-title":"NDSS","author":"Cui Ang","year":"2013","unstructured":"Ang Cui, Michael Costello, and Salvatore Stolfo. 2013. When firmware modifications attack: A case study of embedded exploitation. In NDSS."},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cola.2022.101171"},{"key":"e_1_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1145\/3579990.3580012"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3062341.3062387"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1145\/3173162.3177157"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1145\/2594291.2594343"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00003"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24311"},{"key":"e_1_3_2_19_2","unstructured":"Thomas Dullien. [n. d.]. Searching Statically-linked Vulnerable Library Functions in Executable Code. Retrieved 03 August 2022 from https:\/\/googleprojectzero.blogspot.com\/2018\/12\/searching-statically-linked-vulnerable.html"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23185"},{"key":"e_1_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3052995"},{"key":"e_1_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978370"},{"key":"e_1_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3240480"},{"key":"e_1_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE59848.2023.00013"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.3390\/fi15090314"},{"key":"e_1_3_2_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS52919.2021.9486386"},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180228"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2016.50"},{"key":"e_1_3_2_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICPC.2017.22"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2018.00019"},{"key":"e_1_3_2_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3052974"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/3652032.3657572"},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPRO.2015.10"},{"key":"e_1_3_2_34_2","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2018.8330221"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.01.008"},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516713"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/357062.357071"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534380"},{"key":"e_1_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238199"},{"key":"e_1_3_2_40_2","unstructured":"LLVM Project. 2022. LLVM Block Frequency Terminology. Retrieved 03 August 2022 from https:\/\/llvm.org\/docs\/BlockFrequencyTerminology.html"},{"key":"e_1_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635900"},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24415"},{"key":"e_1_3_2_43_2","volume-title":"Proceedings of the USENIX Security","author":"Marcelli Andrea","year":"2022","unstructured":"Andrea Marcelli, Mariano Graziano, Xabier Ugarte-Pedrero, Yanick Fratantonio, Mohamad Mansouri, and Davide Balzarotti. 2022. How machine learning is solving the binary function similarity problem. In Proceedings of the USENIX Security."},{"key":"e_1_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-22038-9_15"},{"key":"e_1_3_2_45_2","volume-title":"Proceedings of the International Conference on Information Security and Cryptology","author":"Ming Jiang","year":"2012","unstructured":"Jiang Ming, Meng Pan, and Debin Gao. 2012. iBinHunt: Binary hunting with inter-procedural control flow. In Proceedings of the International Conference on Information Security and Cryptology."},{"key":"e_1_3_2_46_2","volume-title":"Proceedings of the USENIX Security","author":"Ming Jiang","year":"2017","unstructured":"Jiang Ming, Dongpeng Xu, Yufei Jiang, and Dinghao Wu. 2017. \\(\\lbrace\\) BinSim \\(\\rbrace\\) : Trace-based semantic binary diffing via system call sliced segment equivalence checking. In Proceedings of the USENIX Security."},{"key":"e_1_3_2_47_2","doi-asserted-by":"publisher","DOI":"10.1145\/242857.242869"},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.48"},{"key":"e_1_3_2_49_2","unstructured":"Oreans Technologies. 2022. Themida Overview. Retrieved 03 August 2022 from https:\/\/www.oreans.com\/themida.php"},{"key":"e_1_3_2_50_2","unstructured":"Kexin Pei Zhou Xuan Junfeng Yang Suman Jana and Baishakhi Ray. 2021. Trex: Learning Execution Semantics from Micro-Traces for Binary Similarity. arXiv:2012.08680. Retrieved from https:\/\/arxiv.org\/abs\/2012.08680"},{"key":"e_1_3_2_51_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.49"},{"key":"e_1_3_2_52_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSM.2004.1357803"},{"key":"e_1_3_2_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454035"},{"key":"e_1_3_2_54_2","unstructured":"River Riddle. [n. d.]. Interprocedural IR Outlining For Code Size. Retrieved 03 August 2022 from https:\/\/llvm.org\/devmtg\/2017-10\/slides\/Riddle-Interprocedural%20IR%20Outlining%20For%20Code%20Size.pdf"},{"key":"e_1_3_2_55_2","doi-asserted-by":"publisher","DOI":"10.1145\/2886012"},{"key":"e_1_3_2_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.51"},{"key":"e_1_3_2_57_2","doi-asserted-by":"publisher","DOI":"10.1145\/3264820.3264821"},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1145\/263867.263872"},{"key":"e_1_3_2_59_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.46"},{"key":"e_1_3_2_60_2","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534367"},{"key":"e_1_3_2_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3041655"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115645"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970312"},{"key":"e_1_3_2_64_2","unstructured":"xorpd. [n. d.]. FCatalog. Retrieved 03 August 2022 from https:\/\/www.xorpd.net\/pages\/fcatalog.html"},{"key":"e_1_3_2_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2018.00073"},{"key":"e_1_3_2_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598121"},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00084"},{"key":"e_1_3_2_68_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2018.2827379"},{"key":"e_1_3_2_69_2","doi-asserted-by":"publisher","DOI":"10.1145\/3604611"},{"key":"e_1_3_2_70_2","doi-asserted-by":"publisher","DOI":"10.1145\/3579990.3580007"},{"key":"e_1_3_2_71_2","doi-asserted-by":"publisher","DOI":"10.1109\/CAHPC.2005.26"},{"key":"e_1_3_2_72_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179482"},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23492"},{"key":"e_1_3_2_74_2","unstructured":"zynamics GmbH and Google LLC. 2022. BinDiff Manual. Retrieved 03 August 2022 from http:\/\/www.zynamics.com\/bindiff\/manual\/index.html"}],"container-title":["ACM Transactions on Architecture and Code Optimization"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3701992","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3701992","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:57:16Z","timestamp":1750298236000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3701992"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,19]]},"references-count":73,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,3,31]]}},"alternative-id":["10.1145\/3701992"],"URL":"https:\/\/doi.org\/10.1145\/3701992","relation":{},"ISSN":["1544-3566","1544-3973"],"issn-type":[{"value":"1544-3566","type":"print"},{"value":"1544-3973","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3,19]]},"assertion":[{"value":"2023-11-07","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-10-09","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-03-19","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}