CFG Obfuscated method of preventing CFG generation from using debugging tools to transform relative address jump into indirect jump between basic block in native code and apparatus therefor

摘要

A method and apparatus for transforming all relative address jumps between basic blocks in native code into indirect jumps to prevent CFG generation of analysis tool are disclosed. The method for preventing CFG generation according to an embodiment of the present invention includes a step of disassembling a native code to confirm a relative address jump instruction between blocks; a step of selecting a register for an indirect jump; a step of transforming the identified relative address jump to an indirect jump using a selected register; and a step of generating a native code formed by transforming the identified relative address jump into the indirect jump.