Software Self-Defense Systems and Methods

• US 20110035733A1
• Filed: 08/11/2010
• Published: 02/10/2011
• Est. Priority Date: 07/29/1999
• Status: Active Grant

• Current Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Original Assignee: Intertrust Technologies Corporation (Fidelio Acquisition Co LLC)
• Inventors: Matheson, Lesley R., Maheshwari, Umesh, Horning, James J., Sibert, W. Olin, Owicki, Susan S., Wright, Andrew K., Tarjan, Robert E., Horne, William G.
• Granted Patent: US 8,387,022 B2
• Time in Patent Office: Days
• US Class Current: 717/140
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 11/362 Software debugging
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

Systems and methods are disclosed for protecting a computer program from unauthorized analysis and modification. Obfuscation transformations can be applied to the computer program'"'"'s local structure, control graph, and/or data structure to render the program more difficult to understand and/or modify. Tamper-resistance mechanisms can be incorporated into the computer program to detect attempts to tamper with the program'"'"'s operation. Once an attempt to tamper with the computer program is detected, the computer program reports it to an external agent, ceases normal operation, and/or reverses any modifications made by the attempted tampering. The computer program can also be watermarked to facilitate identification of its owner. The obfuscation, tamper-resistance, and watermarking transformations can be applied to the computer program'"'"'s source code, object code, or executable image.

Claims

1. A method for obfuscating a computer program, the computer program being designed to carry out one or more specified tasks, the method including:

compiling a source code representation of the computer program to obtain an object code representation of the computer program;

searching the object code representation of the computer program to find first and second object code sequences, the first and second object code sequences being similar, at least in part;

modifying the object code representation of the computer program by;

inserting a third object code sequence into the object code representation of the computer program, the third object code sequence comprising one or more instructions, and being operable to pass control to the first object code sequence;

inserting a branch at the end of the first object code sequence, the branch being operable to;

pass control, upon detection of a first predefined condition, to an instruction following the first object code sequence, and to pass control, upon detection of a second predefined condition, to an instruction following the third object code sequence;

whereby the third object code sequence is executed in place of the second object code sequence without materially affecting completion of the one or more specified tasks.

2. A method as in claim 1, further including:

removing the second object code sequence from the object code representation of the computer program.

3. A method as in claim 1, wherein the first and second object code sequences do not correspond directly to an integer number of source code statements in the source code representation of the computer program.

4. A method as in claim 3, in which the first and second object code sequences each include an object code representation of a first sub-part of a source code programming statement, but do not include an object code representation of at least a second sub-part of the source code programming statement.

5. A method as in claim 1, further including:

searching the object code representation of the computer program to find a fourth object code sequence, the fourth object code sequence being similar, at least in part, to the first and second object code sequences;

inserting a fifth object code sequence into the object code representation of the computer program, the fifth object code sequence comprising one or more instructions, and being operable to pass control to the first object code sequence;

wherein the branch at the end of the first object code sequence is further operable to pass control, upon detection of a third predefined condition, to an instruction following the fifth object code sequence, and whereby the fifth object code sequence is executed in place of the fourth object code sequence without materially affecting completion of the one or more specified tasks.

6. A method as in claim 1, in which modifying the object code representation of the computer program further includes:

duplicating a basic block in the object code representation of the computer program; and

inserting a branch into the object code representation of the computer program, the branch being operable to pass control to one duplicate of the basic block upon detection of a fourth predefined condition, and to pass control to another duplicate of the basic block upon detection of a fifth predefined condition.

7. A method as in claim 6, further including obfuscating the similarities between duplicates of the basic block.

8. A method as in claim 1, in which the third object code sequence further comprises one or more instructions for overwriting at least a portion of the first object code sequence.

9. A method as in claim 8, in which one or more programming instructions for passing control to the first object code sequence, and the one or more object code instructions for overwriting at least a portion of the first object code sequence, are separated in the object code representation of the computer program by at least one intervening instruction.

10. A method for obfuscating a computer program, the computer program being designed to carry out one or more specified tasks, the method including:

searching the computer program for first and second code sequences, the first and second code sequences being similar, at least in part;

inserting a third code sequence into the computer program, the third code sequence including one or more instructions for overwriting at least a portion of the first code sequence, and for passing control to the first code sequence;

inserting a branch at the end of the first code sequence, the branch being operable to;

pass control, upon detection of a first predefined condition, to an instruction following the first code sequence, and to pass control, upon detection of a second predefined condition, to an instruction following the third code sequence;

whereby the third code sequence is executed in place of the second code sequence without materially affecting completion of the one or more specified tasks.

11. A method as in claim 10, in which the computer program is written in a high-level language selected from the group of programming languages consisting of:

C, C++, Visual Basic, Basic, FORTRAN, Cobol, Java, Modula, Pascal, Perl, and Lisp.

12. A method as in claim 10, in which the first predefined condition comprises a predetermined variable having a first value, and the second predefined condition comprises the predetermined variable having a second value.

13. A method as in claim 10, further including:

removing the second code sequence from the computer program.

14. A method for obfuscating a computer program, the method including:

selecting a sequence of programming statements, the sequence of programming statements having a predefined order;

incorporating at least a first concurrent process and a second concurrent process into the computer program;

incorporating at least a first programming statement from the sequence into the first concurrent process;

incorporating at least a second programming statement from the sequence into the second concurrent process;

controlling execution of the first concurrent process and the second concurrent process such that the sequence of programming statements is executed in the predefined order.

15. A method as in claim 14, in which execution of the first programming statement depends on a first predefined condition, and in which execution of the second programming statement depends on a second predefined condition.

16. A method as in claim 15, in which the first concurrent process includes one or more programming statements that are operable to cause the second predefined condition to be satisfied following execution of the first programming statement.

17. A method as in claim 14, in which the first and second concurrent processes comprise first and second sequences of statements in a loop, respectively, and in which execution of the first sequence of statements is dependent on a first predefined condition, and in which execution of the second sequence of statements is dependent on a second predefined condition.

18. A method as in claim 14, in which the first and second concurrent processes comprise first and second threads.

19. A method as in claim 15, in which the first predefined condition comprises a predetermined variable having a first value, and the second predefined condition comprises the predetermined variable having a second value.

20. A method as in claim 19, in which the first value is any one of a first range of predefined values, and the second value is any one of a second range of predefined values.