Protecting a computer program against reverse engineering

• US 10,482,221 B2
• Filed: 02/22/2016
• Issued: 11/19/2019
• Est. Priority Date: 03/02/2015
• Status: Active Grant

• Current Assignee: Inventio AG (Schindler Holding AG)
• Original Assignee: Inventio AG (Schindler Holding AG)
• Inventors: Gilli, Markus
• Primary Examiner(s): Nguyen, Phil K
• Application Number:
  US15/554,830
• Publication Number:
  US 20180181729A1
• Time in Patent Office: 1,366 Days
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 21/1066 Hiding content
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method of protecting a computer program against reverse engineering includes: obfuscating and/or encrypting at least one program library of the computer program, wherein the at least one program library contains byte code adapted for being executed by a virtual machine; including the at least one obfuscated and/or encrypted library into a bootstrap library, the bootstrap library including a bootstrap module adapted for loading the at least one program library into the virtual machine and for starting the computer program; encrypting the bootstrap library; and including the encrypted bootstrap library into a native code launcher executable including a launcher module adapted for starting the virtual machine, decrypting the bootstrap library and for loading the bootstrap library into the virtual machine.

Claims

1. A method of protecting a computer program against reverse engineering, the method comprising the steps of:

at least one of obfuscating and encrypting at least one program library of the computer program, wherein the at least one program library contains byte code adapted for being executed by a virtual machine;

including the at least one program library into a bootstrap library, the bootstrap library including a bootstrap module adapted for loading the at least one program library into the virtual machine and for starting the computer program;

encrypting the bootstrap library;

including the encrypted bootstrap library into a native code launcher executable including a launcher module adapted for starting the virtual machine,

decrypting the bootstrap library and for loading the bootstrap library into the virtual machine;

wherein the bootstrap library included a first key for decrypting the at least one program library and wherein the bootstrap module is adapted for decrypting the at least one program library with the first key.

2. The method according to claim 1 wherein a second key for decrypting the bootstrap library is included into the launcher executable and wherein the launcher executable is adapted for decrypting the bootstrap library with the second key.

3. The method according to claim 1 wherein a key for decrypting the bootstrap library is included into the launcher executable and wherein the launcher executable is adapted for decrypting the bootstrap library with the key.

4. The method according to claim 1 wherein the bootstrap library is obfuscated before being encrypted.

5. The method according to claim 1 wherein at least one of the at least one program library and the bootstrap library is encrypted and decrypted with an RC4 algorithm.

6. The method according to claim 1 wherein a further program library containing byte code is directly included into the bootstrap library.

7. The method according to claim 1 wherein at least one of the at least one program library and the bootstrap library contains CIL byte code or JAVA byte code.

8. A method of launching a protected computer program comprising the steps of:

starting a launcher module of a native code launcher executable, the native code launcher executable containing an encrypted bootstrap library, the encrypted bootstrap library containing at least one program library being at least one of obfuscated and encrypted;

starting a virtual machine with the launcher module;

decrypting the bootstrap library with the launcher module;

loading a bootstrap module of the bootstrap library into the virtual machine and starting the bootstrap module with the launcher module; and

loading a program library contained in the bootstrap library into the virtual machine and starting the program library with the bootstrap module;

resolving a call to an encrypted further program library by the bootstrap module by;

waiting for the call;

decrypting the further program library after the call; and

loading the further program library into the virtual machine.

9. The method according to claim 8 further comprising decrypting the program library with the bootstrap module.

10. The method according to claim 8 further comprising:

detecting, by the launcher module, whether a debugger is active; and

terminating the launching when an active debugger is detected.

11. The method according to claim 8 further comprising:

testing, with the launcher module, whether the computer program is allowed to run on a system that executes the launcher executable; and

terminating when the computer program is not allowed to run on the system.

12. A computer program product comprises a non-transitory computer readable medium stored instructions that when executed by a processor, cause the processor to perform the steps of:

starting a launcher module of a native code launcher executable,

the native code launcher executable containing an encrypted bootstrap library,

the encrypted bootstrap library containing at least one program library being at least one of obfuscated and encrypted;

starting a virtual machine with the launcher module;

decrypting the bootstrap library with the launcher module;

loading a bootstrap module of the bootstrap library into the virtual machine and starting the bootstrap module with the launcher module; and

loading a program library contained in the bootstrap library into the virtual

machine and starting the program library with the bootstrap module;

wherein the native code launcher executable containing native code;

wherein the encrypted bootstrap library contained in the launcher executable; and

at least one program library being at least one of obfuscated and encrypted contained in the bootstrap library.

13. The computer program product according to claim 12 wherein the launcher executable is contained in one data file, and the bootstrap library containing the at least one program library is stored in the one data file.