Software obfuscation

• US 20060005250A1
• Filed: 02/17/2005
• Published: 01/05/2006
• Est. Priority Date: 06/12/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wu, Wei, El-Gammal, Mohammed, Bennett, Julie D., Chu, Frank Nian-Tzu
• Granted Patent: US 7,559,091 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Tampering with pieces of software is inhibited. Software obfuscation inhibits reverse engineering by hackers by manipulating names of functions and adding jump instructions into various pieces of software. Profiles are stored in a central hierarchical database and such profiles are protected from tampering. The obfuscation of a software image so as to becloud the comprehension of hackers in reverse engineering pieces of software comprising the software image is provided.

Claims

1. Computer-readable media having computer-executable instructions stored thereon for use by a computing system to protect software tampering, comprising:

a protection dynamic link library containing obfuscated computer-executable instructions that monitor a database for tampering, verify the originality of a set of files, and stop unauthorized services from execution.

2. The computer-readable media of claim 1, further comprising pieces of source code, which can be compiled and linked, to produce a protection dynamic link library containing non-obfuscated computer-executable instructions that monitor a database for tampering, verify the originality of a set of files, and stop unauthorized services from execution.

3. The computer-readable media of claim 2, further comprising an obfuscation control file containing names of classes, methods, and fields in the protection dynamic link library that contains non-obfuscated computer-executable instructions, the obfuscation file being used to obfuscate the names of classes, methods, and fields in the protection dynamic link library that contains non-obfuscated computer-executable instructions to produce the protection dynamic link library containing obfuscated computer-executable instructions.

4. The computer-readable media of claim 3, further comprising a catalog file containing a checksum of the protection dynamic link library.

5. The computer-readable media of claim 4, further comprising a digitally signed catalog file containing the catalog file and an encrypted checksum of the digitally signed catalog file using a secret private key.

6. A computer-implemented method for producing computer-readable media having computer-executable instructions stored thereon for use by a computing system to inhibit software tampering, the method comprising:

forming an obfuscated protection dynamic link library that monitors a database for tampering, verifies the originality of a set of files, and stops unauthorized services from execution, in which names of classes, methods, fields, and control flows are obfuscated; and

creating a digitally signed catalog file that contains a checksum of the obfuscated protection dynamic link library.

7. The method of claim 6, further comprising creating pieces of source code containing computer-executable instructions that monitor the database for tampering, verify the originality of a set of files, and stop unauthorized services from execution, the act of creating pieces of source code occurring prior to the act of forming the obfuscated protection dynamic link library.

8. The method of claim 7, further comprising compiling and linking the pieces of source code to form a protection dynamic link library that contains computer-executable instructions that monitor the database for tampering, verify the originality of a set of files, and stop unauthorized services from execution.

9. The method of claim 8, further comprising calculating the checksum of the obfuscated protection dynamic link library, and creating a catalog file to store the checksum of the obfuscated protection dynamic link library.

10. The method of claim 9, further comprising calculating the checksum of the catalog file, encrypting the checksum of the catalog file using a secret private key, and digitally signed the catalog file to produce the digitally signed catalog file.

12. The computer-readable medium of claim 6, creating pieces of source code containing computer-executable instructions that monitor the database for tampering, verify the originality of a set of files, and stop unauthorized services from execution, the act of creating pieces of source code occurring prior to the act of forming the obfuscated protection dynamic link library.

13. The computer-readable medium of claim 7, compiling and linking the pieces of source code to form a protection dynamic link library that contains computer-executable instructions that monitor the database for tampering, verify the originality of a set of files, and stop unauthorized services from execution.

14. The computer-readable medium of claim 8, further comprising calculating the checksum of the obfuscated protection dynamic link library, and creating a catalog file to store the checksum of the obfuscated protection dynamic link library.

15. The computer-readable medium of claim 9, further comprising calculating the checksum of the catalog file, encrypting the checksum of the catalog file using a secret private key, and digitally signed the catalog file to produce the digitally signed catalog file.

11. A computer-readable medium having computer-executable instructions stored thereon for implementing a method that inhibits software tampering, comprising:

forming an obfuscated protection dynamic link library that monitors a database for tampering, verifies the originality of a set of files, and stops unauthorized services from execution, in which names of classes, methods, fields, and control flows are obfuscated; and

creating a digitally signed catalog file that contains a checksum of the obfuscated protection dynamic link library.

16. A system for producing computer-readable media having computer-executable instructions stored thereon for use by a computing system to inhibit software tampering, the method comprising:

means for forming an obfuscated protection dynamic link library that monitors a database for tampering, verifies the originality of a set of files, and stops unauthorized services from execution, in which names of classes, methods, fields, and control flows are obfuscated; and

means for creating a digitally signed catalog file that contains a checksum of the obfuscated protection dynamic link library.

17. The system of claim 16, further comprising means for creating pieces of source code containing computer-executable instructions that monitor the database for tampering, verify the originality of a set of files, and stop unauthorized services from execution, the act of creating pieces of source code occurring prior to the act of forming the obfuscated protection dynamic link library.

18. The system of claim 17, further comprising means for compiling and linking the pieces of source code to form a protection dynamic link library that contains computer-executable instructions that monitor the database for tampering, verify the originality of a set of files, and stop unauthorized services from execution.

19. The system of claim 18, further comprising means for calculating the checksum of the obfuscated protection dynamic link library, and creating a catalog file to store the checksum of the obfuscated protection dynamic link library.

20. The method of claim 19, further comprising means for calculating the checksum of the catalog file, encrypting the checksum of the catalog file using a secret private key, and digitally signed the catalog file to produce the digitally signed catalog file.