Software self-defense systems and methods

• US 20050204348A1
• Filed: 05/13/2005
• Published: 09/15/2005
• Est. Priority Date: 07/29/1999
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Matheson, Lesley R., Maheshwari, Umesh, Horning, James J., Sibert, W. Olin, Wright, Andrew K., Tarjan, Robert E., Horne, William G., Owicki, Susan
• Granted Patent: US 7,779,270 B2
• Time in Patent Office: Days
• US Class Current: 717/140
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 11/362 Software debugging
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

Systems and methods are disclosed for protecting a computer program from unauthorized analysis and modification. Obfuscation transformations can be applied to the computer program'"'"'s local structure, control graph, and/or data structure to render the program more difficult to understand and/or modify. Tamper-resistance mechanisms can be incorporated into the computer program to detect attempts to tamper with the program'"'"'s operation. Once an attempt to tamper with the computer program is detected, the computer program reports it to an external agent, ceases normal operation, and/or reverses any modifications made by the attempted tampering. The computer program can also be watermarked to facilitate identification of its owner. The obfuscation, tamper-resistance, and watermarking transformations can be applied to the computer program'"'"'s source code, object code, or executable image.

Claims

1-67. -67. (canceled)

68. A method for protecting an executable computer program from unauthorized tampering, the method including:

adding a first segment of code or data to a portion of the executable program, the first segment of code or data not materially affecting the normal operation of the executable program;

upon a first execution of a first predefined code sequence in the executable program, overwriting at least part of a first memory region containing the first segment of code or data with a second segment of code or data;

upon a subsequent execution of the first predefined code sequence, overwriting at least part of a memory region substantially adjacent to the first memory region with a third segment of code or data, such that at least part of the executable program is overwritten with the third segment of code or data.

69. A method as in claim 68, in which the third segment of code or data comprises invalid instructions or data.

79. A method as in claim 68, in which the first predefined code sequence comprises startup code.

80. A method as in claim 68, in which the second memory region is substantially logically or physically adjacent to the first memory region.

70. A method for protecting an executable computer program against unauthorized tampering, the method including:

monitoring the number of times a first predefined code sequence is executed before a second predefined code sequence is executed;

if the first predefined code sequence is executed more than a predetermined number of times before the second predefined code sequence is executed, overwriting at least part of the executable program, or data upon which the executable program relies, with invalid instructions or data.

81. A method as in claim 70, in which the first predefined code sequence comprises startup code.

71-72. -72. (canceled)

73. A method for implementing one or more self-defensive techniques in a computer program, the method including:

(a)(1) generating a primed computer program by inserting a first piece of code into the computer program;

(b)(1) finding the first piece of code at a first location in the primed computer program;

(c)(1) inserting a second piece of computer code into the primed computer program at the first location, the second piece of computer code being operable to perform a self-defense action.

74. A method as in claim 73, in which finding the first piece of code in the primed computer program includes:

searching the primed computer program for a predefined pattern associated with the first piece of code.

75. A method as in claim 73, in which the first piece of code comprises an executable code sequence, the method further including:

(a)(2) compiling and linking the primed computer program.

76. A method as in claim 73, in which the first piece of code is inserted using a binary code modification tool.

77. A method as in claim 73, in which the second piece of computer code is operable to check the value of a variable, the value of the variable being operable to indicate whether the computer program has been tampered with.

78. A method as in claim 73, in which the second piece of computer code is operable to perform a test for tampering on at least a portion of the computer program.