Obfuscation evaluation method and obfuscation method

• US 8,108,689 B2
• Filed: 10/27/2006
• Issued: 01/31/2012
• Est. Priority Date: 10/28/2005
• Status: Expired due to Fees

• Current Assignee: Sovereign Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Panasonic Corporation (Panasonic Holdings Corporation)
• Inventors: Nicolson, Kenneth Alexander, Asai, Rieko, Sato, Taichi
• Primary Examiner(s): Goodarzi, Nasser
• Assistant Examiner(s): Yalew, Fikremariam A
• Application Number:
  US12/091,224
• Publication Number:
  US 20090119515A1
• Time in Patent Office: 1,922 Days
• Field of Search: None
• US Class Current: 713/190
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

An obfuscation evaluation method which sufficiently evaluates an obfuscation performed on a program. The obfuscation evaluation method includes: a step of executing an obfuscated code module produced by obfuscating an original code module of a program, and generating a trace output file by logging a result of the execution; and a step of identifying the degree of obfuscation of the obfuscated code module by evaluating the trace output file.

Claims

1. An obfuscation method for obfuscating a program using a processor, said obfuscation method comprising:

an obfuscation step of generating, using the processor, an obfuscated code by obfuscating original code of the program;

a first execution step of executing the obfuscated code generated in said obfuscation step;

a first logging step of generating first logging data by logging execution details of said first execution step;

an evaluation step of evaluating the first logging data, thereby identifying a degree of obfuscation of the obfuscated code; and

a re-obfuscation step of re-obfuscating the original code based on a result of the evaluation performed in said evaluation step.

2. The obfuscation method according to claim 1, further comprising:

a second execution step of executing the original code; and

a second logging step of generating second logging data by logging execution details of said second execution step,

wherein in said evaluation step, the first logging data is compared with the second logging data and evaluated.

3. The obfuscation method according to claim 2,

wherein in said obfuscation step, fundamental blocks present in the original code are obfuscated and block mapping information is produced, the block mapping information indicating a correspondence between the fundamental blocks of the original code and the fundamental blocks of the obfuscated code, and

wherein in said evaluation step, the first logging data is evaluated per corresponding fundamental block using the block mapping information.

4. The obfuscation method according to claim 3,

wherein in said re-obfuscation step, a block of the original code is selected based on a result of the evaluation in said evaluation step, and the selected block is re-obfuscated.

5. The obfuscation method according to claim 1,

wherein in said obfuscation step, control information that includes obfuscation parameters is used, and the original code is obfuscated in accordance with the parameters.

6. The obfuscation method according to claim 1,

wherein in said evaluation step, evaluation result data, which indicates a result of evaluating the first logging data, is generated in a format that is readable in said re-obfuscation step.

7. The obfuscation method according to claim 1,

wherein in said evaluation step, evaluation result data, which indicates a result of evaluating the first logging data, is generated, and the format of the evaluation result data is converted into a format that is readable in said re-obfuscation step.

8. The obfuscation method according to claim 1,

wherein in said evaluation step, a numerical value, which is an indicator of the degree of obfuscation, is calculated as a metric, based on the first logging data.

9. The obfuscation method according to claim 8, further comprising

a metric judgment step of judging whether or not the metric calculated in said evaluation step is within a permissible range,

wherein each time the metric is judged as not being within the permissible range in said metric judgment step, (i) new obfuscated code is generated by re-obfuscating the original code in said re-obfuscation step, and (ii) said first execution step, said first logging step, said evaluation step, and said metric judgment step are repeated for the new obfuscated code, and

wherein when the metric is judged as being within the permissible range in said metric judgment step, the original code is not re-obfuscated in said re-obfuscation step.

10. The obfuscation method according to claim 9,

wherein in said evaluation step, an average value of plural numerical values, which are indicators of the degree of obfuscation, is calculated as the metric, based on the first logging data.

11. The obfuscation method according to claim 9,

wherein in said evaluation step, plural numerical values, which are indicators of the degree of obfuscation, are weighted, and an average of the weighted plural numerical values is calculated as the metric, based on the first logging data.

12. The obfuscation method according to claim 1, further comprising

a number judgment step of judging whether or not the number of times obfuscation has been performed on the original code has exceeded a pre-set number of times,

wherein each time it is judged that the pre-set number of times has not been exceeded in said number judgment step, (i) new obfuscated code is generated by re-obfuscating the original code in said re-obfuscation step, and (ii) said first execution step, said first logging step, said evaluation step, and said number judgment step are repeated for the new obfuscated code, and

wherein when it is judged that the pre-set number of times has been exceeded in said number judgment step, the original code is not re-obfuscated in said re-obfuscation step.

13. The obfuscation method according to claim 1, further comprising

a time judgment step of judging whether or not the amount of time required for performing obfuscation on the original code has exceeded a pre-set amount of time,

wherein each time it is judged that the pre-set amount of time has not been exceeded in said time judgment step, (i) new obfuscated code is generated by re-obfuscating the original code in said re-obfuscation step, and (ii) said first execution step, said first logging step, said evaluation step, and said time judgment step are repeated for the new obfuscated code, and

wherein when it is judged that the pre-set amount of time has been exceeded in said time judgment step, the original code is not re-obfuscated in said re-obfuscation step.

14. The obfuscation method according to claim 1,

wherein said first execution step, said first logging step, and said evaluation step are repeated for a new obfuscated code generated by the re-obfuscating in said re-obfuscation step, and

wherein said obfuscation method further comprises

a continuance step of comparing a degree of obfuscation identified in an immediately preceding evaluation step with a degree of obfuscation identified in an obfuscation step ahead of said immediately preceding evaluation step, and repeating said steps from said re-obfuscation step, based on the a result of the comparison.

15. An obfuscation apparatus for obfuscating a program, comprising at least one processor configured to operate as:

an obfuscation unit operable to generate an obfuscated code by obfuscating original code of the program;

an execution unit operable to execute the obfuscated code generated by said obfuscation unit;

a logging unit operable to generate logging data by logging execution details of said execution unit;

an evaluation unit operable to evaluate the logging data, thereby identifying a degree of obfuscation of the obfuscated code; and

a re-obfuscation unit operable to re-obfuscate the original code based on a result of the evaluation performed by said evaluation unit.

16. A non-transitory storage medium having stored thereon an obfuscation program for obfuscating a program, wherein, when executed, said obfuscation program causes a computer to perform a method comprising:

an obfuscation step of generating an obfuscated code by obfuscating original code of the program;

an execution step of executing the obfuscated code generated in said obfuscation step;

a logging step of generating logging data by logging execution details of said execution step;

an evaluation step of evaluating the logging data, thereby identifying a degree of obfuscation of the obfuscated code; and

a re-obfuscation step of re-obfuscating the original code based on a result of the evaluation performed in said evaluation step.

17. An integrated circuit for obfuscating a program, comprising at least one processor configured to operate as:

an obfuscation unit operable to generate an obfuscated code by obfuscating original code of the program;

an execution unit operable to execute the obfuscated code generated by said obfuscation unit;

a logging unit operable to generate logging data by logging execution details of said execution unit;

an evaluation unit operable to evaluate the logging data, thereby identifying a degree of obfuscation of the obfuscated code; and

a re-obfuscation unit operable to re-obfuscate the original code based on a result of the evaluation performed by said evaluation unit.