Method and system for protecting software applications against static and dynamic software piracy techniques

• US 7,111,285 B2
• Filed: 07/16/2002
• Issued: 09/19/2006
• Est. Priority Date: 07/17/2001
• Status: Active Grant

• Current Assignee: Liquid Machines, Inc. (Check Point Software Technologies Limited)
• Original Assignee: Liquid Machines, Inc. (Check Point Software Technologies Limited)
• Inventors: Bala, Vasanth, Smith, Michael D.
• Primary Examiner(s): Zhen, Wei
• Assistant Examiner(s): CHOW, CHIH CHING
• Application Number:
  US10/197,063
• Publication Number:
  US 20030018906A1
• Time in Patent Office: 1,526 Days
• Field of Search: 713/167, 713/190, 705/51, 705/55, 705/56, 726/23, 726/33
• US Class Current: 717/140
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 2221/2103 Challenge-response

Abstract

An application module is rewritten by overwriting executable code at identified authorization points with control transfers to a managed challenge system such that a rewritten application module results. The managed challenge system is constructed to include the overwritten executable code, and performs an authorization check upon acquiring control from an authorization point. The managed challenge system is linked to the rewritten application module.

Claims

1. A method for protecting a software application module, comprising:

given an application module having executable code, constructing a managed challenge system specific to the application module, said constructing including copying certain executable code from the application module and forming the managed challenge system, the certain executable code being at identified authorization points in the application module;

rewriting the application module by overwriting the certain executable code at identified authorization points with control transfers to the managed challenge system, such that a rewritten application module results;

for a byte sequence in the application module which matches one of said control transfers and which does not correspond with an identified authorization point, including dummy code in the managed challenge system;

associating said dummy code with said byte sequence; and

linking the managed challenge system to the rewritten application module wherein the steps of rewriting, constructing and linking are able to be performed by a compiler, the compiler creating a shared object that includes the managed challenge system and that is linked with the rewritten application module; and

wherein the step of rewriting further comprises, without access to source code, instrumenting the application module'"'"'s executable code.

2. The method of claim 1, further comprising:

identifying the authorization points in the software application module.

3. The method of claim 2, wherein identifying authorization points comprises:

determining special pragmas used for code/data protection and associated with source code of the application module at the authorization points.

4. The method of claim 3, further comprising:

modifying a compiler to recognize the special pragmas, the compiler performing the steps of rewriting, constructing and linking.

5. The method of claim 3, wherein each special pragma comprises authorization check data for its authorization point.

6. The method of claim 2, wherein identifying authorization points comprises:

producing a set of associations between authorization points and authorization check data, the step of rewriting being based on the set of associations.

7. The method of claim 2, wherein identifying authorization points comprises:

constructing a control flow graph for the application module; and

analyzing the control flow graph to identify authorization points.

8. The method of claim 7, wherein the control flow graph is incomplete.

9. The method of claim 8, further comprising:

increasing coverage of the control flow graph by tracing execution of the application module under different input data sets.

10. The method of claim 1, further comprising:

associating a particular authorization check with an identified authorization point.

11. The method of claim 1, wherein a control transfer is implemented with an instruction sequence comprising at least one instruction.

12. The method of claim 11, wherein the instruction sequence causes a runtime exception.

13. The method of claim 12, wherein an address of the instruction sequence uniquely identifies the control transfer.

14. The method of claim 12, wherein an instruction of the instruction sequence is any of:

i) an interrupt instruction, and ii) a debug breakpoint instruction.

15. The method of claim 1, wherein each control transfer is uniquely identified.

16. The method of claim 1, wherein a control transfer is implemented with a call to the managed challenge system.

17. The method of claim 16, wherein the call includes a return address that uniquely identifies the control transfer.

18. The method of claim 1, further comprising:

in the rewritten application module, hiding from an adversary the control transfers to the managed challenge system.

19. The method of claim 18, wherein hiding a control transfer at a particular identified authorization point comprises:

selecting and removing, for the particular identified authorization point, a set of control transfers whose removal would effectively make finding the authorization point using static analysis impossible.

20. The method of claim 19, wherein selecting and removing a set of control transfers comprises:

removing one or more control transfers in a manner such that ability of reaching the authorization point is minimized.

21. The method of claim 20, further comprising:

using a control flow graph to select control transfers for removal.

22. The method of claim 19, wherein the set is selected such that runtime overhead is minimized.

23. The method of claim 19, where removing one of the set of control transfers comprises:

further rewriting the application module by overwriting the control transfer with a control transfer instruction sequence, the instruction sequence comprising at least one instruction and transferring control, upon its execution, to the managed challenge system; and

including in the managed challenge system the overwritten transfer control.

24. The method of claim 1, further comprising:

disabling, if said byte sequence is a valid instruction, any of execution of said dummy code, and

inclusion of said dummy code.

25. The method of claim 1, further comprising:

determining whether said byte sequence is part of another valid instruction; and

including and associating said dummy code responsive to said determination.

26. The method of claim 1, further comprising:

upon failure of the authorization check, performing a specified action.

27. The method of claim 26, wherein the specified action is any of:

i) terminating execution of the application module; and

ii) requesting authorization information from a user.

28. The method of claim 1, further comprising, upon success of the authorization check:

executing the copied certain executable code; and

returning control to the application module.

29. The method of claim 1, further comprising:

in the step of constructing the managed challenge system, modifying the copied certain executable code to account for its displacement from the given application module.

30. The method of claim 1, further comprising:

combining the copied certain executable code with code for the authorization check into a single instruction sequence.

31. The method of claim 30, wherein combining comprises:

merging the copied certain executable code with the authorization check code by interspersing their respective instructions into the single instruction sequence.

32. The method of claim 1, further comprising:

obfuscating executable code within the managed challenge system.

33. The method of claim 1, further comprising:

storing, in a table in the managed challenge system, any combination of i) merged code sequences corresponding to authorization points in the application module, ii) hidden code sequences corresponding to removed control transfers in the application module, and iii) dummy code sequences corresponding to non-authorization point code sequences, wherein the table is indexed by a unique identifier associated with each control transfer in the application module.

34. The method of claim 33, further comprising:

encrypting the merged, hidden and dummy code sequences.

35. The method of claim 33, further comprising:

upon transfer of control to the managed challenge system, dynamically generating an executable code sequence from an entry in said table corresponding to an identifier associated with the control transfer from which control was transferred to the managed challenge system.

36. The method of claim 35, further comprising:

maintaining the generated executable code sequences in a code cache of the managed challenge system.

37. The method of claim 36, wherein the code cache is sized such that it is not large enough to simultaneously contain all dynamically created code sequences.

38. The method of claim 35, further comprising:

tracking overhead of dynamically generating an executable code sequence;

based on said tracking overhead, determining whether to undo the step of rewriting.

39. The method of claim 1, wherein the application module is a content protection module.

40. The method of claim 1, wherein different byte sequences are used to transfer control to the managed challenge system from different authorization points in the application module.

41. A computer system for protecting a software application module, comprising:

a coupling tool which rewrites the application module to form a modified application module by overwriting certain executable code at identified authorization points with control transfers to a managed challenge system,

the managed challenge system being application specific and being formed of;

a copy of the certain executable code from the application module before the overwriting, and a runtime task table associating the identified authorization points with authorization check data and with the copied certain executable code, the authorization check data describing an authorization check to be performed upon control reaching the associated authorization point; and

a coupling agent specialized from a coupling agent template, the coupling agent managing the managed challenge system, and the coupling tool linking the managed challenge system to the modified application module and wherein the coupling tool includes, for a byte sequence in the modified application module which matches one of said control transfers and which does not correspond with an identified authorization point, dummy code in the managed challenge system, and associates said dummy code with said byte sequence.

42. The system of claim 41, wherein authorization points are identified by special pragmas used for code/data protection that have been associated with source code of the application module at the authorization points.

43. The system of claim 42, wherein a compiler is modified to recognize the special pragmas, the compiler rewriting the application module, constructing the managed challenge system and linking the application module with the managed challenge system.

44. The system of claim 42, wherein each special pragma comprises authorization check data for its authorization point.

45. The system of claim 41, authorization points being identified with a set of associations between authorization points and authorization check data, the application module being rewritten based on the set of associations.

46. The system of claim 41, further comprising:

an analysis tool which identifies authorization points by constructing a control flow graph for the application module, and analyzes the control flow graph to identify authorization points.

47. The system of claim 46, wherein the control flow graph is incomplete.

48. The system of claim 47, wherein the analysis tool increases coverage of the control flow graph by tracing execution of the application module under different input data sets.

49. The system of claim 41, wherein a control transfer is implemented with an instruction sequence comprising at least one instruction.

50. The system of claim 49, wherein the instruction sequence causes a runtime exception.

51. The system of claim 50, wherein an address of the instruction sequence uniquely identifies the control transfer.

52. The system of claim 50, wherein an instruction of the instruction sequence is any of:

i) an interrupt instruction, and ii) a debug breakpoint instruction.

53. The system of claim 41, wherein each control transfer is uniquely identified.

54. The system of claim 41, wherein a control transfer is implemented with a call to the managed challenge system.

55. The system of claim 54, wherein the call includes a return address that uniquely identifies the control transfer.

56. The system of claim 41, the coupling tool further in the modified application module, hiding from an adversary the control transfers to the managed challenge system.

57. The system of claim 56, wherein the coupling tool hides a control transfer at a particular identified authorization point by selecting and removing, for the particular identified authorization point, a set of control transfers whose removal would effectively make finding the authorization point using static analysis impossible.

58. The system of claim 57, wherein the coupling tool selects and removes a set of control transfers by removing one or more control transfers in a manner such that ability of reaching the authorization point is minimized.

59. The system of claim 58, further comprising:

an analysis tool that uses a control flow graph to select control transfers for removal.

60. The system of claim 57, wherein the set is selected such that runtime overhead is minimized.

61. The system of claim 57, wherein one of the set of control transfers is removed by further overwriting the control transfer with a control transfer instruction sequence, and by including in the managed challenge system a copy of the control transfer, wherein the instruction sequence comprises at least one instruction and transfers control, upon its execution, to the managed challenge system.

62. The system of claim 41, wherein, if said byte sequence is a valid instruction, then any of the following is disabled:

execution of said dummy code, and

inclusion of said dummy code.

63. The system of claim 41, wherein the coupling tool includes and associates said dummy code based on a determination as to whether said byte sequence is part of another valid instruction.

64. The system of claim 41, wherein the managed challenge system, upon failure of the authorization check, performs a specified action.

65. The system of claim 64, wherein the specified action is any of:

i) terminating execution of the application module; and

ii) requesting authorization information from a user.

66. The system of claim 41, wherein the managed challenge system, upon success of the authorization check, executes the copy of the certain executable code, and returns control to the application module.

67. The system of claim 41, wherein the copy of the certain executable code is modified to account for its displacement from the application module.

68. The system of claim 41, wherein the coupling tool combines the copy of the certain executable code with code for the authorization check into a single instruction sequence.

69. The system of claim 68, wherein the coupling tool combines the copy of the certain executable code with the authorization check code by merging the copied certain executable code with the authorization check code by interspersing their respective instructions into the single instruction sequence.

70. The system of claim 41, wherein the coupling tool obfuscates executable code within the managed challenge system.

71. The system of claim 41, further comprising:

a protected code store, in which the coupling tool stores any combination of;

i) merged code sequences corresponding to authorization points in the application module,

ii) hidden code sequences corresponding to removed control transfers in the application module, and

iii) dummy code sequences corresponding to non-authorization point code sequences.

72. The system of claim 71, wherein the merged, hidden and dummy code sequences are encrypted.

73. The system of claim 71, wherein the coupling agent comprises:

a dynamic code generator which generates an executable code sequence on demand at run time from a stored code sequence corresponding to an identifier associated with a control transfer from which control was transferred to the managed challenge system.

74. The system of claim 73, wherein the coupling agent further comprises:

a code cache for storing generated code sequences; and

a cache management module which manages the code cache.

75. The system of claim 74, wherein the code cache is sized such that it is not large enough to simultaneously contain all dynamically created code sequences.

76. The system of claim 73, wherein the coupling agent tracks overhead of dynamically generating an executable code sequence, and based on said tracking, determines whether to undo the rewriting of the application module.

77. The system of claim 41, wherein the coupling tool is integrated with a compiler which creates a shared object that includes the managed challenge system and that is linked with the rewritten application module.

78. The system of claim 41, wherein the coupling tool rewrites the application module without access to source code, by instrumenting the application module'"'"'s executable code.

79. The system of claim 41, wherein the application module is a content protection module.

80. The system of claim 41, wherein different byte sequences are used to transfer control to the managed challenge system from different authorization points in the application module.

81. A computer system for protecting a software application module, comprising:

means for rewriting the application module by overwriting certain executable code at identified authorization points with control transfers to a managed challenge system;

means for constructing the managed challenge system to be specific to the application module, the managed challenge system including a copy of the certain executable code from the application module before the overwriting, the managed challenge system performing an authorization check upon acquiring control from an authorization point; and

means for linking the managed challenge system to the rewritten application module, wherein for a byte sequence in the rewritten application module which matches one of said control transfers and which does not correspond with an identified authorization point, including dummy code in the managed challenge system and associating said dummy code with said byte sequence.