System and method for branch extraction obfuscation

• US 8,589,897 B2
• Filed: 08/26/2008
• Issued: 11/19/2013
• Est. Priority Date: 08/26/2008
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Myles, Gideon M., Lerouge, Julien, Lattner, Tanya Michelle, Farrugia, Augustin J.
• Primary Examiner(s): Tsai, Henry
• Assistant Examiner(s): ROCHE, JOHN B
• Application Number:
  US12/198,873
• Publication Number:
  US 20100058301A1
• Time in Patent Office: 1,911 Days
• Field of Search: None
• US Class Current: 717/142
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/447 Target code generation
• CPC Class Codes: G06F 9/44521 Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading

Abstract

Disclosed herein are systems, methods, and computer readable-media for obfuscating code. The method includes extracting a conditional statement from a computer program, creating a function equivalent to the conditional statement, creating a pointer that points to the function, storing the pointer in an array of pointers, replacing the conditional statement with a call to the function using the pointer at an index in the array, and during runtime of the computer program, dynamically calculating the index corresponding to the pointer in the array. In one aspect, a subset of instructions is extracted from a path associated with the conditional statement and the subset of instructions is placed in the function to evaluate the conditional statement. In another aspect, the conditional statement is replaced with a call to a select function that (1) calculates the index into the array, (2) retrieves the function pointer from the array using the index, and (3) calls the function using the function pointer. Calls can be routed through a select function before the function pointer is used to call the function evaluating the conditional statement. Each step in the method can be applied to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

Claims

1. A method of obfuscating code, the method comprising:

identifying a Boolean statement in a conditional statement in a computer program, wherein when executed the Boolean statement evaluates to a Boolean output value in response to one or more input values;

creating a function that when executed evaluates to the Boolean output value in response to the one or more input values;

extracting a subset of intructions from a path associated with the conditional statement;

removing the subset of instructions from the path and inserting the subset of instructions in the function; and

replacing the Boolean statement with a call to the function, the function called using a pointer obtained from an array of pointers, wherein an index in the array identifying the pointer is dynamically calculated during execution of the computer program.

2. The method of claim 1, wherein the Boolean statement is replaced with a call to a select function, the select function comprising:

calculating, during the execution of the program, the index into the array,

retrieving a function pointer from the array using the index, and

calling the function using the function pointer.

3. The method of claim 1, wherein each step is applicable to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

4. The method of claim 1, wherein the pointer is a function pointer.

5. The method of claim 1, wherein the index is dynamically calculated during an initialization period in runtime or right before the call to the function using the pointer.

6. A system for obfuscating code, the system comprising:

a processor;

a module configured to control the processor to identify a Boolean statement in a conditional statement in a computer program, wherein when executed the Boolean statement evaluates to a Boolean output value in response to a one or more input values;

a module configured to control the processor to create a function that when executed evaluates to the Boolean output value in response to the one or more input values;

a module configured to control the processor to extract a subset of instructions from a path associated with the conditional statement;

a module configured to control the processor to remove the subset of instructions from the path and insert the subset of instructions in the function; and

a module configured to control the processor to replace the Boolean statement in the conditional statement with a call to the function, the function called using a pointer obtained from an array of pointers, wherein an index in the array identifying the pointer is dynamically calculated during execution of the computer program.

7. The system of claim 6, wherein the Boolean statement is replaced with a call to a select function, the select function comprising:

calculating, during the execution of the program, the index into the array,

retrieving a function pointer from the array using the index, and

calling the function using the function pointer.

8. The system of claim 6, wherein each step is applicable to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

9. The system of claim 6, wherein the pointer is a function pointer.

10. The system of claim 6, wherein the index is dynamically calculated during an initialization period in runtime or right before the call to the function using the pointer.

11. A non-transitory computer-readable medium storing a computer program having instructions for obfuscating code, the instructions comprising:

identifying a Boolean statement in a conditional statement in a computer program, wherein when executed the Boolean statement evaluates to a Boolean output value in response to a one or more input values;

creating a function that when executed evaluates to the Boolean output value in response to the one or more input values;

extracting a subset of instructions from a path associated with the conditional statement;

removing the subset of instructions from the path and inserting the subset of instructions in the function; and

replacing the Boolean statement with a call to the function, the function called using a pointer obtained from an array of pointers, wherein an index in the array identifying the pointer is dynamically calculated during execution of the computer program.

12. The non-transitory computer-readable medium of claim 11, wherein the Boolean statement is replaced with a call to a select function, the select function comprising:

calculating, during the execution of the program, the index into the array,

retrieving a function pointer from the array using the index, and

calling the function using the function pointer.

13. The non-transitory computer-readable medium of claim 11, wherein each step is applicable to source code of the computer program, an intermediate representation of the computer program, and assembly code of the computer program.

14. The non-transitory computer-readable medium of claim 11, wherein the index is dynamically calculated during an initialization period in runtime or right before the call to the function using the pointer.