Multiple instruction dispatch tables for application program obfuscation

• US 7,353,499 B2
• Filed: 09/25/2003
• Issued: 04/01/2008
• Est. Priority Date: 09/25/2003
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: de Jong, Eduard K.
• Primary Examiner(s): Zhen; Wei
• Assistant Examiner(s): Chen; Qing
• Application Number:
  US10/672,183
• Publication Number:
  US 20050071652A1
• Time in Patent Office: 1,650 Days
• Field of Search: 717106-109, 717124-135, 713189-194, 726/26
• US Class Current: 717/127
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441
• CPC Class Codes: H04L 9/34 Bits, or blocks of bits, of the telegraphic message being interchanged in time for speech signals H04K1/06

Abstract

Obfuscating an application program comprises reading an application program comprising code, determining multiple dispatch tables associated with the application program, transforming the application program into application program code configured to utilize the dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least in part on a current instruction counter value, and sending the application program code. Executing an obfuscated application program comprises receiving an obfuscated application program comprising at least one instruction opcode value encoded using one of multiple instruction set opcode value encoding schemes, receiving an application program instruction corresponding to a current instruction counter value, selecting an instruction dispatch table based at least in part on the current instruction counter value, and executing the application program instruction using the selected instruction dispatch table.

Claims

1. A method for executing an obfuscated application program, the method comprising:

receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

receiving an application program instruction corresponding to a current instruction counter value;

selecting an instruction dispatch table based at least on said current instruction counter value, wherein said selecting comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation; and

executing said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.

2. The method of claim 1, further comprising:

determining whether there is another application program instruction to be executed;

advancing said current instruction counter if there is another application program instruction to be executed; and

repeating said receiving said application program instruction, said selecting and said executing after said advancing.

3. The method of claim 1 wherein the number of instruction dispatch tables is based at least on a number of instructions in a method of said obfuscated application program.

4. The method of claim 3 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

5. The method of claim 4 wherein said number of instruction dispatch tables equals said number of instructions.

6. The method of claim 1 wherein the number of instruction dispatch tables is based at least on an amount of available memory.

7. A method for application program obfuscation, the method comprising:

reading an application program comprising code;

determining a plurality of dispatch tables associated with said application program;

transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and selecting the dispatch table associated with the result of said modulo-n arithmetic operation; and

sending said application program code.

8. The method of claim 7 wherein said determining further comprises determining the encoding of said plurality of dispatch tables based at least on a relative frequency of instructions in said application program code.

9. The method of claim 7 wherein said determining further comprises filtering said plurality of dispatch tables to flatten the frequency distribution of instructions over said transformed application program code.

10. The method of claim 7 wherein

said method further comprises, after said transforming, applying a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program;

and

said sending comprises sending said encrypted obfuscated application program.

11. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for executing an obfuscated application program, the method comprising:

receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

receiving an application program instruction corresponding to a current instruction counter value;

selecting an instruction dispatch table based at least on said current instruction counter value, wherein said selecting comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation; and

executing said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.

12. The program storage device of claim 11, said method further comprising:

determining whether there is another application program instruction to be executed;

advancing said current instruction counter if there is another application program instruction to be executed; and

repeating said receiving said application program instruction, said selecting and said executing after said advancing.

13. The program storage device of claim 11 wherein the number of instruction dispatch tables is based at least on a number of instructions in a method of said obfuscated application program.

14. The program storage device of claim 13 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

15. The program storage device of claim 14 wherein said number of instruction dispatch tables equals said number of instructions.

16. The program storage device of claim 11 wherein the number of instruction dispatch tables is based at least on an amount of available memory.

17. A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for application program obfuscation, the method comprising:

reading an application program comprising code;

determining a plurality of dispatch tables associated with said application program;

transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and selecting the dispatch table associated with the result of said modulo-n arithmetic operation; and

sending said application program code.

18. The program storage device of claim 17 wherein said determining further comprises determining the encoding of said plurality of dispatch tables based at least on a relative frequency of instructions in said application program code.

19. The program storage device of claim 17 wherein said determining further comprises filtering said plurality of dispatch tables to flatten the frequency distribution of instructions over said transformed application program code.

20. The program storage device of claim 17 wherein

said method further comprises, after said transforming, applying a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program;

and

said sending comprises sending said encrypted obfuscated application program.

21. An apparatus for executing an obfuscated application program, the apparatus comprising:

means for receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

means for receiving an application program instruction corresponding to a current instruction counter value;

means for selecting an instruction dispatch table based at least on said current instruction counter value, wherein said means for selecting comprises means for performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and means for selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation; and

means for executing said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.

22. The apparatus of claim 21, further comprising:

means for determining whether there is another application program instruction to be executed;

means for advancing said current instruction counter if there is another application program instruction to be executed; and

means for repeating said receiving said application program instruction, said selecting and said executing after said advancing.

23. The apparatus of claim 21 wherein the number of instruction dispatch tables is based at least on a number of instructions in a method of said obfuscated application program.

24. The apparatus of claim 23 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

25. The apparatus of claim 24 wherein said number of instruction dispatch tables equals said number of instructions.

26. The apparatus of claim 21 wherein the number of instruction dispatch tables is based at least on an amount of available memory.

27. An apparatus for application program obfuscation, the apparatus comprising:

a processor; and

a memory, coupled to said processor, having stored therein computer readable instructions wherein executing said computer readable instructions on said processor provides;

means for reading an application program comprising code;

means for determining a plurality of dispatch tables associated with said application program;

means for transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises means for performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and means for selecting the dispatch table associated with the result of said modulo-n arithmetic operation; and

means for sending said application program code.

28. The apparatus of claim 27 wherein said means for determining further comprises means for determining the encoding of said plurality of dispatch tables based at least on a relative frequency of instructions in said application program code.

29. The apparatus of claim 27 wherein said means for determining further comprises filtering said plurality of dispatch tables to flatten the frequency distribution of instructions over said transform&

d application program code.

30. The apparatus of claim 27 wherein

said apparatus further comprises, means for applying a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program in response to said transforming;

and

said means for sending comprises means for sending said encrypted obfuscated application program.

31. An apparatus for executing an obfuscated application program, the apparatus comprising a user device configured to:

receive an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;

receive an application program instruction corresponding to a current instruction counter value;

select an instruction dispatch table based at least on said current instruction counter value, wherein to select said instruction dispatch table based at least on said current instruction counter value comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and select the instruction dispatch table associated with the result of said modulo-n arithmetic operation; and

execute said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.

32. The apparatus of claim 31, said user device further configured to:

determine whether there is another application program instruction to be executed;

advance said current instruction counter if there is another application program instruction to be executed; and

repeat said receiving said application program instruction, said selecting and said executing after said advancing.

33. The apparatus of claim 31 wherein the number of instruction dispatch tables is based at least on a number of instructions in a method of said obfuscated application program.

34. The apparatus of claim 33 wherein said number of instruction dispatch tables is greater than or equal to said number of instructions.

35. The apparatus of claim 34 wherein said number of instruction dispatch tables equals said number of instructions.

36. The apparatus of claim 31 wherein the number of instruction dispatch tables is based at least on an amount of available memory.

37. An apparatus for application program obfuscation, the apparatus comprising an application program provider including a processor, and memory, coupled to said processor, having stored therein computer readable instructions wherein upon executing said computer readable instructions on said processor said application program provider is configured to:

read an application program comprising code;

determine a plurality of dispatch tables associated with said application program;

transform said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on use of a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and select the dispatch table associated with the result of said modulo-n arithmetic operation; and

send said application program code.

38. The apparatus of claim 37 wherein said application program provider is further configured to determine the encoding of said plurality of dispatch tables based at least on a relative frequency of instructions in said application program code.

39. The apparatus of claim 37 wherein said application program provider is further configured to filter said plurality of dispatch tables to flatten the frequency distribution of instructions over said transformed application program code.

40. The apparatus of claim 37 wherein

said application program provider is further configured to apply a cryptographic process to said application program code together with a cryptographic key to create an encrypted obfuscated application program;

and

said application program provider is further configured to send said encrypted obfuscated application program.

41. A data processing system comprising:

a processor; and

memory, coupled to said processor, for storing data for access by an application program being executed on said data processing system, said memory comprising;

a data structure stored in said memory, said data structure including information used by said application program to execute an obfuscated application program on said data processing system, said data structure comprising application program code configured to utilize a plurality of dispatch tables during execution of said obfuscated application program to determine a location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and select the dispatch table associated with the result of said modulo-n arithmetic operation.

42. The data processing system of claim 41 wherein said data structure further comprises a cryptographic key and protected data, said protected data encrypted using said cryptographic key.

43. The data processing system of claim 41 wherein said data structure further comprises an obfuscation descriptor that indicates an obfuscation method used to create said obfuscated application program.

44. A data processing system comprising:

a processor; and

memory, coupled to said processor, for storing data for access by an application program being executed on said data processing system, said memory comprising;

a data structure stored in said memory, said data structure including information used by said application program to execute an obfuscated application program, said data structure comprising a plurality of dispatch tables used during execution of said obfuscated application program to determine a location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−

1, and select the dispatch table associated with the result of said modulo-n arithmetic operation.