Multiple instruction dispatch tables for application program obfuscation
First Claim
1. A method for executing an obfuscated application program, the method comprising:
- receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;
receiving an application program instruction corresponding to a current instruction counter value;
selecting an instruction dispatch table based at least on said current instruction counter value, wherein said selecting comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation; and
executing said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.
2 Assignments
0 Petitions
Accused Products
Abstract
Obfuscating an application program comprises reading an application program comprising code, determining multiple dispatch tables associated with the application program, transforming the application program into application program code configured to utilize the dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value, and sending the application program code. Executing an obfuscated application program comprises receiving an obfuscated application program comprising at least one instruction opcode value encoded using one of multiple instruction set opcode value encoding schemes, receiving an application program instruction corresponding to a current instruction counter value, selecting an instruction dispatch table based at least in part on the current instruction counter value, and executing the application program instruction using the selected instruction dispatch table.
-
Citations
44 Claims
-
1. A method for executing an obfuscated application program, the method comprising:
-
receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes; receiving an application program instruction corresponding to a current instruction counter value; selecting an instruction dispatch table based at least on said current instruction counter value, wherein said selecting comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation; andexecuting said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method for application program obfuscation, the method comprising:
-
reading an application program comprising code; determining a plurality of dispatch tables associated with said application program; transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and selecting the dispatch table associated with the result of said modulo-n arithmetic operation; andsending said application program code. - View Dependent Claims (8, 9, 10)
-
-
11. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for executing an obfuscated application program, the method comprising:
-
receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes; receiving an application program instruction corresponding to a current instruction counter value; selecting an instruction dispatch table based at least on said current instruction counter value, wherein said selecting comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation; andexecuting said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction. - View Dependent Claims (12, 13, 14, 15, 16)
-
-
17. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for application program obfuscation, the method comprising:
-
reading an application program comprising code; determining a plurality of dispatch tables associated with said application program; transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and selecting the dispatch table associated with the result of said modulo-n arithmetic operation; andsending said application program code. - View Dependent Claims (18, 19, 20)
-
-
21. An apparatus for executing an obfuscated application program, the apparatus comprising:
-
means for receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes; means for receiving an application program instruction corresponding to a current instruction counter value; means for selecting an instruction dispatch table based at least on said current instruction counter value, wherein said means for selecting comprises means for performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and means for selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation; andmeans for executing said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction. - View Dependent Claims (22, 23, 24, 25, 26)
-
-
27. An apparatus for application program obfuscation, the apparatus comprising:
-
a processor; and a memory, coupled to said processor, having stored therein computer readable instructions wherein executing said computer readable instructions on said processor provides; means for reading an application program comprising code; means for determining a plurality of dispatch tables associated with said application program; means for transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises means for performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and means for selecting the dispatch table associated with the result of said modulo-n arithmetic operation; andmeans for sending said application program code. - View Dependent Claims (28, 29, 30)
-
-
31. An apparatus for executing an obfuscated application program, the apparatus comprising a user device configured to:
-
receive an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes; receive an application program instruction corresponding to a current instruction counter value; select an instruction dispatch table based at least on said current instruction counter value, wherein to select said instruction dispatch table based at least on said current instruction counter value comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and select the instruction dispatch table associated with the result of said modulo-n arithmetic operation; andexecute said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction. - View Dependent Claims (32, 33, 34, 35, 36)
-
-
37. An apparatus for application program obfuscation, the apparatus comprising an application program provider including a processor, and memory, coupled to said processor, having stored therein computer readable instructions wherein upon executing said computer readable instructions on said processor said application program provider is configured to:
-
read an application program comprising code; determine a plurality of dispatch tables associated with said application program; transform said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on use of a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and select the dispatch table associated with the result of said modulo-n arithmetic operation; andsend said application program code. - View Dependent Claims (38, 39, 40)
-
-
41. A data processing system comprising:
-
a processor; and memory, coupled to said processor, for storing data for access by an application program being executed on said data processing system, said memory comprising; a data structure stored in said memory, said data structure including information used by said application program to execute an obfuscated application program on said data processing system, said data structure comprising application program code configured to utilize a plurality of dispatch tables during execution of said obfuscated application program to determine a location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and select the dispatch table associated with the result of said modulo-n arithmetic operation. - View Dependent Claims (42, 43)
-
-
44. A data processing system comprising:
-
a processor; and memory, coupled to said processor, for storing data for access by an application program being executed on said data processing system, said memory comprising; a data structure stored in said memory, said data structure including information used by said application program to execute an obfuscated application program, said data structure comprising a plurality of dispatch tables used during execution of said obfuscated application program to determine a location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−
1, and select the dispatch table associated with the result of said modulo-n arithmetic operation.
-
Specification