Opaque Predicate

Created the Saturday 23 March 2019. Updated 1 year, 2 months ago.

Opaque predicate is a term used in programming to refer to decision making where there is only one possible outcome. This can be achieved through the use of complex or hard-to-understand logic, such as calculating a value that will always return True.

Opaque predicates are often used as anti-disassembling techniques, as they can make it difficult for an analyst to understand the code and determine its intent. By using opaque predicates, malware authors can make their code more difficult to reverse engineer, which can help to evade detection and analysis.

Technique Identifiers

U0201 B0032.019

Technique Tags

Complex logic Hard-to-understand code Single-path decision making Always-true conditions Anti-disassembling Reverse engineering evasion Malware detection evasion

Code Snippets

Description

In this code, the first opaque predicate is similar to the previous example, where the value of z is calculated by multiplying x and y, which will always result in the value 15. The if statement then checks if z is equal to 15, which is always the case. This makes it difficult for an analyst to understand the intent of the code, as the logic behind the if statement is not immediately apparent.

The code then goes on to create another opaque predicate using the values of a and b. In this case, the value of c is calculated by subtracting b from a, which will always result in the value 5. The if statement then checks if c is equal to 5, which is always the case. This adds another layer of complexity to the code, making it even more difficult to understand and reverse engineer. By using multiple opaque predicates, malware authors can create highly obfuscated code that is very difficult to analyze.

int main() {
    int x = 3;
    int y = 5;
    int z = x * y;

    // Opaque predicate: z will always be equal to 15,
    // so this if statement will always be true
    if (z == 15) {
        // Do something malicious

        // Create another opaque predicate
        int a = 10;
        int b = 5;
        int c = a - b;

        // This if statement will also always be true
        if (c == 5) {
            // Do something even more malicious
        }
    }
}

About Author Open Snippet

Author: Unprotect / Target Platform: Windows

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

https://www.carbonblack.com/2019/02/25/defeating-compiler-level-obfuscations-used-in-apt10-malware/