Reversing Obfuscated Code of a Java Card Through Code Reconstruction

Abstract

In secure devices like Java Cards, several attacks have been developed to dump memory and reverse its contents, thereby gaining access to sensitive stored assets. Many manufacturers have proposed various countermeasures to protect this data from malicious code. Obfuscation is one of these techniques; it consists of converting part or all of the code into another form that is much harder to understand in order to make the reverse engineering of memory dumps more difficult. This conversion occurs instantly during downloading. In this paper, we propose an automatic approach to reverse engineer obfuscated intermediate bytecode based on a backtracking search algorithm. We then introduce heuristics to optimize the search process and accelerate convergence toward realistic solutions. We implement this approach in a prototype, and, to improve it, we integrate it into the Java Card Disassembler and Analyzer (JCDA) tool. We also explain the new tricks used by our tool to recover some secure assets. Our tool successfully reversed 92% of illegal opcodes and all secure assets.