SYSTEM AND METHOD FOR BRANCH EXTRACTION OBFUSCATION

• US 20100058301A1
• Filed: 08/26/2008
• Published: 03/04/2010
• Est. Priority Date: 08/26/2008
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: MYLES, Ginger M., Farrugia, Augustin J., Lattner, Tanya Michelle, Lerouge, Julien
• Granted Patent: US 8,589,897 B2
• Time in Patent Office: Days
• US Class Current: 717/142
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/447 Target code generation
• CPC Class Codes: G06F 9/44521 Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading

Abstract

Disclosed herein are systems, methods, and computer readable-media for obfuscating code. The method includes extracting a conditional statement from a computer program, creating a function equivalent to the conditional statement, creating a pointer that points to the function, storing the pointer in an array of pointers, replacing the conditional statement with a call to the function using the pointer at an index in the array, and during runtime of the computer program, dynamically calculating the index corresponding to the pointer in the array. In one aspect, a subset of instructions is extracted from a path associated with the conditional statement and the subset of instructions is placed in the function to evaluate the conditional statement. In another aspect, the conditional statement is replaced with a call to a select function that (1) calculates the index into the array, (2) retrieves the function pointer from the array using the index, and (3) calls the function using the function pointer. Calls can be routed through a select function before the function pointer is used to call the function evaluating the conditional statement. Each step in the method can be applied to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

Claims

1. A method of obfuscating code, the method comprising:

extracting a conditional statement from a computer program;

creating a function equivalent to the conditional statement;

creating a pointer that points to the function;

storing the pointer in an array of pointers;

replacing the conditional statement with a call to the function using the pointer at an index in the array; and

during runtime of the computer program, dynamically calculating the index corresponding to the pointer in the array.

2. The method of claim 1, the method further comprising:

extracting a subset of instructions from a path associated with the conditional statement; and

placing the subset of instructions in the function to evaluate the conditional statement.

3. The method of claim 1, wherein the conditional statement is replaced with a call to a select function that (1) calculates the index into the array, (2) retrieves the function pointer from the array using the index, and (3) calls the function using the function pointer.

4. The method of claim 1, wherein calls are routed through a select function before the function pointer is used to call the function equivalent to the conditional statement.

5. The method of claim 1, wherein each step is applicable to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

6. The method of claim 1, wherein the pointer is a function pointer.

7. The method of claim 1, wherein the index is dynamically calculated during an initialization period in runtime or right before the call to the function using the pointer.

8. A system for obfuscating code, the system comprising:

a module configured to extract a conditional statement from a computer program;

a module configured to create a function equivalent to the conditional statement;

a module configured to create a pointer that points to the function;

a module configured to store the pointer in an array of pointers;

a module configured to replace the conditional statement with a call to the function using the pointer at an index in the array; and

a module configured to, during runtime of the computer program, dynamically calculate the index corresponding to the pointer in the array.

9. The system of claim 8, the system further comprising:

a module configured to extract a subset of instructions from a path associated with the conditional statement; and

a module configured to place the subset of instructions in the function to evaluate the conditional statement.

10. The system of claim 8, wherein the conditional statement is replaced with a call to a select function that (1) calculates the index into the array, (2) retrieves the function pointer from the array using the index, and (3) calls the function using the function pointer.

11. The system of claim 8, wherein calls are routed through a select function before the function pointer is used to call the function equivalent to the conditional statement.

12. The system of claim 8, wherein each step is applicable to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

13. The system of claim 8, wherein the pointer is a function pointer.

14. The system of claim 8, wherein the index is dynamically calculated during an initialization period in runtime or right before the call to the function using the pointer.

15. A computer-readable medium storing a computer program having instructions for obfuscating code, the instructions comprising:

extracting a conditional statement from a computer program;

creating a function equivalent to the conditional statement;

creating a pointer that points to the function;

storing the pointer in an array of pointers;

replacing the conditional statement with a call to the function using the pointer at an index in the array; and

during runtime of the computer program, dynamically calculating the index corresponding to the pointer in the array.

16. The computer-readable medium of claim 15, the instructions further comprising:

extracting a subset of instructions from a path associated with the conditional statement; and

placing the subset of instructions in the function to evaluate the conditional statement.

17. The computer-readable medium of claim 15, wherein the conditional statement is replaced with a call to a select function that (1) calculates the index into the array, (2) retrieves the function pointer from the array using the index, and (3) calls the function using the function pointer.

18. The computer-readable medium of claim 15, wherein calls are routed through a select function before the function pointer is used to call the function equivalent to the conditional statement.

19. The computer-readable medium of claim 15, wherein each step is applicable to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

20. The computer-readable medium of claim 15, wherein the index is dynamically calculated during an initialization period in runtime or right before the call to the function using the pointer.