Method of obfuscating computer instruction streams

• US 20030023859A1
• Filed: 07/25/2001
• Published: 01/30/2003
• Est. Priority Date: 07/25/2001
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Computer Incorporated (Apple Inc.)
• Inventors: Kiddy, Raymond R.
• Granted Patent: US 6,694,435 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

Methods and apparatuses for obfuscating computer instruction streams. In one aspect of the invention, an exemplary method includes breaking each of at least two operative instruction streams into a plurality of parts and interleaving the parts into a new instruction stream. In another aspect of the invention, an exemplary method includes breaking each of at least two operative instruction streams into a plurality of parts and interleaving the parts with obfuscation codes into a new instruction stream. The obfuscation codes interrelate the parts from different instruction streams to prevent reversal of interleaving.

Claims

1. A method comprising:

breaking each of at least two operative instruction streams into a plurality of parts;

interleaving the parts into a new instruction stream.

2. A method as in claim 1 further comprising:

inserting into the new instruction stream an obfuscation code that interrelates the parts from the operative instruction streams.

3. A method as in claim 1 further comprising:

transforming at least one of the parts after said breaking and before said interleaving.

4. A method as in claim 3 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.

5. A method as in claim 1 further comprising:

transforming one of the operative instruction streams before said breaking.

6. A method as in claim 1 wherein two of the operative instruction streams are the same.

7. A digital processing system comprising:

means for breaking each of at least two operative instruction streams into a plurality of parts;

means for interleaving the parts into a new instruction stream.

8. A digital processing system as in claim 7 further comprising:

means for inserting into the new instruction stream an obfuscation code that interrelates the parts from the operative instruction streams.

9. A digital processing system as in claim 7 further comprising:

means for transforming at least one of the parts after said breaking and before said interleaving.

10. A digital processing system as in claim 9 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.

11. A digital processing system as in claim 7 further comprising:

means for transforming one of the operative instruction streams before said breaking.

12. A digital processing system as in claim 7 wherein two of the operative instruction streams are the same.

13. A machine readable media containing executable computer program instructions which when executed by a digital processing system cause said system to perform a method comprising:

breaking each of at least two operative instruction streams into a plurality of parts;

interleaving the parts into a new instruction stream.

14. A machine readable media as in claim 13 wherein the method further comprises:

inserting into the new instruction stream an obfuscation code that interrelates the parts from the operative instruction streams.

15. A machine readable media as in claim 13 wherein the method further comprises:

transforming at least one of the parts after said breaking and before said interleaving.

16. A machine readable media as in claim 15 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.

17. A machine readable media as in claim 13 wherein the method further comprises:

transforming one of the operative instruction streams before said breaking.

18. A machine readable media as in claim 13 wherein two of the operative instruction streams are the same.

19. A processing system for combining computer instruction streams, said processing system comprising:

a processor;

a memory coupled to said processor, said memory storing at least two operative instruction streams, said processor breaking each of the streams into a plurality of parts, said processor interleaving the parts into a new instruction stream.

20. A processing system as in claim 19 wherein said processor inserts into the new instruction stream an obfuscation code that interrelates the parts from the operative instruction streams.

21. A processing system as in claim 19 wherein said processor transforms at least one of the parts after breaking each of the streams and before interleaving the parts.

22. A processing system as in claim 21 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.

23. A processing system as in claim 19 wherein said processor transforms one of the operative instruction streams before breaking each of the streams.

24. A processing system as in claim 19 wherein two of the operative instruction streams are the same.

25. A machine readable media containing an obfuscated instruction stream which is executable by a digital processing system, said obfuscated instruction stream is produced by a method comprising:

breaking each of at least two operative instruction streams into a plurality of parts;

interleaving the parts into a new instruction stream.

26. A machine readable media as in claim 25 wherein the method further comprises:

inserting into the new instruction stream obfuscation codes that interrelate the parts from the operative instruction streams.

27. A machine readable media as in claim 25 wherein the method further comprises:

transforming at least one of the parts after said breaking and before said interleaving.

28. A machine readable media as in claim 27 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.

29. A machine readable media as in claim 25 wherein the method further comprises:

transforming the operative instruction streams before said breaking.

30. A machine readable media as in claim 25 wherein two of the operative instruction streams are the same.

31. A method comprising:

storing an obfuscated stream;

executing said obfuscated stream, wherein said obfuscated stream comprises parts which are interleaved, said parts having been taken from at least two operative instruction streams.

32. A method as in claim 31 wherein said obfuscated stream further comprises an obfuscation code that interrelates the parts from the operative instruction streams.

33. A method as in claim 31 wherein at least one of said parts has been transformed before said parts are interleaved and after said parts are taken from the operative instruction streams.

34. A method as in claim 31 wherein at least one of said parts has been so transformed before said parts are interleaved and after said parts are taken from the operative instruction streams that the obfuscated stream performs at least the same logical operations of one of the operative instruction streams.

35. A method as in claim 31 wherein one of the operative instruction streams has been transformed before said parts are taken from the operative instruction streams.

36. A method as in claim 31 wherein two of the operative instruction streams are the same.

37. A machine readable media containing executable computer program instructions which when executed by a digital processing system cause said system to perform a method comprising:

storing an obfuscated stream;

executing said obfuscated stream, wherein said obfuscated stream comprises parts which are interleaved, said parts having been taken from at least two operative instruction streams.

38. A machine readable media as in claim 37 wherein said obfuscated stream is stored temporarily in DRAM.

39. A machine readable media as in claim 37 wherein said obfuscated stream further comprises an obfuscation code that interrelates the parts from the operative instruction streams.

40. A machine readable media as in claim 39 wherein said obfuscated stream is stored temporarily in DRAM.

41. A machine readable media as in claim 37 wherein at least one of said parts has been transformed before said parts are interleaved and after said parts are taken from the operative instruction streams.

42. A machine readable media as in claim 41 wherein said obfuscated stream is stored temporarily in DRAM.

43. A machine readable media as in claim 37 wherein at least one of said parts has been so transformed before said parts are interleaved and after said parts are taken from the operative instruction streams that the obfuscated stream performs at least the same logical operations of one of the operative instruction streams.

44. A machine readable media as in claim 37 wherein one of the operative instruction streams has been transformed before said parts are taken from the operative instruction streams.

45. A machine readable media as in claim 44 wherein said obfuscated stream is stored temporarily in DRAM.

46. A machine readable media as in claim 37 wherein two of the operative instruction streams are the same.

47. A machine readable media as in claim 46 wherein said obfuscated stream is stored temporarily in DRAM.