Multiple instruction dispatch tables for application program obfuscation

• US 20050071652A1
• Filed: 09/25/2003
• Published: 03/31/2005
• Est. Priority Date: 09/25/2003
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: de Jong, Eduard K.
• Granted Patent: US 7,353,499 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441
• CPC Class Codes: H04L 9/34 Bits, or blocks of bits, of the telegraphic message being interchanged in time for speech signals H04K1/06

Abstract

Obfuscating an application program comprises reading an application program comprising code, determining multiple dispatch tables associated with the application program, transforming the application program into application program code configured to utilize the dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value, and sending the application program code. Executing an obfuscated application program comprises receiving an obfuscated application program comprising at least one instruction opcode value encoded using one of multiple instruction set opcode value encoding schemes, receiving an application program instruction corresponding to a current instruction counter value, selecting an instruction dispatch table based at least in part on the current instruction counter value, and executing the application program instruction using the selected instruction dispatch table.

Claims

1. A method for executing an obfuscated application program, the method comprising:

receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

receiving an application program instruction corresponding to a current instruction counter value;

selecting an instruction dispatch table based at least in part on said current instruction counter value; and

executing said application program instruction using said selected instruction dispatch table.

2. The method of claim 1, further comprising:

determining whether there is another application program instruction to be executed;

advancing said current instruction counter if there is another application program instruction to be executed; and

repeating said receiving, said selecting and said executing after said advancing.

3. The method of claim 1 wherein said selecting further comprises:

performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n-1; and

selecting the instruction dispatch table associated with the result of said operation.

4. The method of claim 1 wherein the number of instruction dispatch tables is based at least in part on the number of instructions in the largest method of said application program.

5. The method of claim 4 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

6. The method of claim 5 wherein said number of instruction dispatch tables equals said number of instructions.

7. The method of claim 1 wherein the number of instruction dispatch tables is based at least in part on an amount of available memory.

8. A method for application program obfuscation, the method comprising:

reading an application program comprising code;

determining a plurality of dispatch tables associated with said application program;

transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value; and

sending said application program code.

9. The method of claim 8 wherein said determining further comprises determining the encoding of said plurality of dispatch tables based at least in part on a relative frequency of instructions in said application program code.

10. The method of claim 8 wherein said determining further comprises filtering said plurality of dispatch tables to flatten the frequency distribution of instructions over said transformed application program code.

11. The method of claim 8 wherein

said method further comprises, after said transforming, applying a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program;

and

said sending comprises sending said encrypted obfuscated application program.

12. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for executing an obfuscated application program, the method comprising:

receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

receiving an application program instruction corresponding to a current instruction counter value;

selecting an instruction dispatch table based at least in part on said current instruction counter value; and

executing said application program instruction using said selected instruction dispatch table.

13. The program storage device of claim 12, said method further comprising:

determining whether there is another application program instruction to be executed;

advancing said current instruction counter if there is another application program instruction to be executed; and

repeating said receiving, said selecting and said executing after said advancing.

14. The program storage device of claim 12 wherein said selecting further comprises:

performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n-1; and

selecting the instruction dispatch table associated with the result of said operation.

15. The program storage device of claim 12 wherein the number of instruction dispatch tables is based at least in part on the number of instructions in the largest method of said application program.

16. The program storage device of claim 15 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

17. The program storage device of claim 16 wherein said number of instruction dispatch tables equals said number of instructions.

18. The program storage device of claim 12 wherein the number of instruction dispatch tables is based at least in part on an amount of available memory.

19. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for application program obfuscation, the method comprising:

reading an application program comprising code;

determining a plurality of dispatch tables associated with said application program;

transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value; and

sending said application program code.

20. The program storage device of claim 19 wherein said determining further comprises determining the encoding of said plurality of dispatch tables based at least in part on a relative frequency of instructions in said application program code.

21. The program storage device of claim 19 wherein said determining further comprises filtering said plurality of dispatch tables to flatten the frequency distribution of instructions over said transformed application program code.

22. The program storage device of claim 19 wherein

said method further comprises, after said transforming, applying a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program;

and

said sending comprises sending said encrypted obfuscated application program.

23. An apparatus for executing an obfuscated application program, the apparatus comprising:

means for receiving an obfuscated application program, said obfuscated application program

comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

means for receiving an application program instruction corresponding to a current instruction counter value;

means for selecting an instruction dispatch table based at least in part on said current instruction counter value; and

means for executing said application program instruction using said selected instruction dispatch table.

24. The apparatus of claim 23, further comprising:

means for determining whether there is another application program instruction to be executed;

means for advancing said current instruction counter if there is another application program instruction to be executed; and

means for repeating said receiving, said selecting and said executing after said advancing.

25. The apparatus of claim 23 wherein said means for selecting further comprises:

means for performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n-1; and

means for selecting the instruction dispatch table associated with the result of said operation.

26. The apparatus of claim 23 wherein the number of instruction dispatch tables is based at least in part on the number of instructions in the largest method of said application program.

27. The apparatus of claim 26 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

28. The apparatus of claim 27 wherein said number of instruction dispatch tables equals said number of instructions.

29. The apparatus of claim 23 wherein the number of instruction dispatch tables is based at least in part on an amount of available memory.

30. An apparatus for application program obfuscation, the apparatus comprising:

means for reading an application program comprising code;

means for determining a plurality of dispatch tables associated with said application program;

means for transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value; and

means for sending said application program code.

31. The apparatus of claim 30 wherein said means for determining further comprises means for determining the encoding of said plurality of dispatch tables based at least in part on a relative frequency of instructions in said application program code.

32. The apparatus of claim 30 wherein said means for determining further comprises filtering said plurality of dispatch tables to flatten the frequency distribution of instructions over said transformed application program code.

33. The apparatus of claim 30 wherein

said apparatus further comprises, means for applying a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program in response to said transforming;

and

said means for sending comprises means for sending said encrypted obfuscated application program.

34. An apparatus for executing an obfuscated application program, the apparatus comprising a user device configured to:

receive an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

receive an application program instruction corresponding to a current instruction counter value;

select an instruction dispatch table based at least in part on said current instruction counter value; and

execute said application program instruction using said selected instruction dispatch table.

35. The apparatus of claim 34, said user device further configured to:

determine whether there is another application program instruction to be executed;

advance said current instruction counter if there is another application program instruction to be executed; and

repeat said receiving, said selecting and said executing after said advancing.

36. The apparatus of claim 34 wherein said user device is further configured to:

perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n-1; and

select the instruction dispatch table associated with the result of said operation.

37. The apparatus of claim 34 wherein the number of instruction dispatch tables is based at least in part on the number of instructions in the largest method of said application program.

38. The apparatus of claim 37 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

39. The apparatus of claim 38 wherein said number of instruction dispatch tables equals said number of instructions.

40. The apparatus of claim 34 wherein the number of instruction dispatch tables is based at least in part on an amount of available memory.

41. An apparatus for application program obfuscation, the apparatus comprising an application program provider configured to:

read an application program comprising code;

determine a plurality of dispatch tables associated with said application program;

transform said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value; and

send said application program code.

42. The apparatus of claim 41 wherein said application program provider is further configured to determine the encoding of said plurality of dispatch tables based at least in part on a relative frequency of instructions in said application program code.

43. The apparatus of claim 41 wherein said application program provider is further configured to filter said plurality of dispatch tables to flatten the frequency distribution of instructions over said transformed application program code.

44. The apparatus of claim 41 wherein

said application program provider is further configured to apply a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program;

and

said application program provider is further configured to send said encrypted obfuscated application program.

45. A memory for storing data for access by an application program being executed on a data processing system, comprising:

a data structure stored in said memory, said data structure including information used by said application program execute an obfuscated application program, said data structure comprising application program code configured to utilize a plurality of dispatch tables during execution of said obfuscated application program to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value.

46. The memory of claim 45 wherein said data structure further comprises a cryptographic key and protected data, said protected data encrypted using said cryptographic key.

47. The memory of claim 45 wherein said data structure further comprises an obfuscation descriptor that indicates an obfuscation method used to create said obfuscated application program.

48. A memory for storing data for access by an application program being executed on a data processing system, comprising:

a data structure stored in said memory, said data structure including information used by said application program execute an obfuscated application program, said data structure comprising a plurality of dispatch tables used during execution of said obfuscated application program to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value.