Compiler Based Obfuscation

• US 20140245271A1
• Filed: 02/28/2013
• Published: 08/28/2014
• Est. Priority Date: 02/28/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Tzen, Ten, Patel, Kalpesh S., Miller, Olaf Alexander, Bostanci, Hakki T., Pashniak, Michael T.
• Granted Patent: US 9,116,712 B2
• Time in Patent Office: Days
• US Class Current: 717/146
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/423 Preprocessors
• CPC Class Codes: G06F 8/4442 Reducing the number of cache misses; Data prefetching cache prefetching G06F12/0862
• CPC Class Codes: G06F 8/445 Exploiting fine grain parallelism, i.e. parallelism at instruction level run-time instruction scheduling G06F9/3836
• CPC Class Codes: G06F 8/47 Retargetable compilers
• CPC Class Codes: G06F 8/51 Source to source
• CPC Class Codes: G06F 8/52 Binary to binary
• CPC Class Codes: G06F 8/70 Software maintenance or management

Abstract

Compiler based obfuscation is described. To protect portions of a code project with obfuscations, the code is modified within a compiler to produce one or more modifications that obfuscate the code as part of a compilation process. A compiled version of the code is generated having the modifications that are produced within the compiler. In one approach, the compiler is configured to consume an obfuscation description that indicates portions of the code to protect and specifies the modifications to make to the indicated portions. Various different modifications of code may be performed during the compilation process to implement corresponding obfuscation features. For example, the modifications made within a compiler may include, but are not limited to, modifications designed to enable tamper detection, anti-debugging, and/or encryption of the code.

Claims

1. A method comprising:

modifying code for a development project within a compiler to produce one or more modifications to obfuscate a portion of the code as part of compilation of the code; and

generating by the compiler a compiled version of the code having the modifications produced within the compiler to obfuscate the portion of code.

2. The method as recited in claim 1, further comprising:

obtaining an obfuscation description having directives that define the modifications; and

applying the obfuscation description to the code to produce the modifications.

3. The method as recited in claim 2, further comprising selectively obfuscating portions of the code based on the obfuscation description, the obfuscation description configured to designate one or more portions of the code to protect and one or more modifications to make to the one or more portions.

4. The method as recited in claim 2, further comprising generating one or more obfuscation algorithms on the fly as part of the compilation process to produce the modifications.

5. The method as recited in claim 4, wherein different obfuscation algorithms are generated for and applied to at least two different portions of the code.

6. The method as recited in claim 2, further comprising:

modifying multiple portions of the code as part of compilation of the code including applying different obfuscation features and modifications on an individual basis to the multiple portions as directed by the directives in the obfuscation description to individualize protection of the multiple portions.

7. The method as recited in claim 1, wherein generating the compiled version of the code comprises producing compiled binary files.

8. The method as recited in claim 1, wherein the modifications comprise at least one of rearranging of code blocks, call redirection, creation of a clone function, changes to symbol attributes and behaviors, segmenting of code blocks, replacing calls, setting absolute references between different portions of the code, or modification of entry points into the code.

9. The method as recited in claim 1, wherein the modifications comprise at least one of insertion of checksums, verifier modules, or verification code.

10. The method as recited in claim 1, wherein the modifications comprise encryption of the portion of code and addition of decryption/re-encryption code.

11. The method as recited in claim 1, wherein the modifications are designed to enable one or more of heap execution, verification, or encryption of the code.

12. The method as recited in claim 1, wherein the modifications comprise virtualization of at least one function to run in an obfuscated form at runtime.

13. The method as recited in claim 1, wherein the modifying comprises:

pre-processing the code to produce intermediate language code that combines source code for the development project with source obfuscation code indicative of the modifications to make to the source code; and

obfuscating the code by applying the modifications to the intermediate language code within the compiler during compilation of the code.

14. One or more computer-readable storage media storing instructions that, when executed by a computing device, implement a compiler module configured to perform operations comprising:

obtaining directives indicative of portions of source code for a development project to protect and modifications to make to obfuscate the indicated portions;

generating intermediate language code that combines the source code with code to implement the directives; and

applying the directives to the intermediate language code to modify the indicated portions in accordance with the directives during compilation of the intermediate language code by the compiler module.

15. One or more computer-readable storage media as described in claim 14, wherein applying the directives to the intermediate language code further comprises:

passing configuration information to an obfuscation module during compilation of the intermediate language code; and

receiving instructions from the obfuscation module configured to cause the compiler module to make the modifications.

16. One or more computer-readable storage media as described in claim 14, wherein the modifications are designed to enable one or more of heap execution, verification, or encryption of the source code.

17. One or more computer-readable storage media as described in claim 14, wherein the compiler module is further configured to perform operations comprising:

compiling obfuscated code produced by application of the directives to the intermediate language code; and

outputting protected compiled code for the development project having obfuscations produced during the compilation of the intermediate language code by the compiler module.

18. A computing device comprising:

a processing system;

one or more modules operable at least in part via hardware of the processing system to implement an integrated development environment (IDE) configured to;

expose a development interface to enable creation of source code for a software development project;

associate with the source code an obfuscation description produced through the development interface to specify modifications for a compiler to make during compilation of the source code to obfuscate one or more selected portions of the source code; and

compile the source code to produce protected compiled code for the development project using the obfuscation description to implement the specified modifications to obfuscate the one or more selected portions during compilation.

19. The computing device of claim 18, wherein the integrated development environment (IDE) comprises an obfuscation module and a compiler module, the obfuscation module operable to produce the obfuscation description and supply the obfuscation description module for consumption by the compiler module, the compiler module operable to compile the source code to produce protected compiled code including obtaining and interpreting the obfuscation description supplied by the obfuscation module to implement corresponding modifications of the source code during compilation.

20. The computing device of claim 18, wherein the integrated development environment (IDE) is configured as a web accessible service available to developers over a network.