System and method for obfuscation by common function and common function prototype

• US 8,645,930 B2
• Filed: 01/04/2010
• Issued: 02/04/2014
• Est. Priority Date: 01/04/2010
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Lattner, Christopher Arthur, Lattner, Tanya Michelle, Lerouge, Julien, Myles, Ginger M., Farrugia, Augustin J., Betouin, Pierre
• Primary Examiner(s): Wong, Don
• Assistant Examiner(s): Rivera, Anibal
• Application Number:
  US12/651,953
• Publication Number:
  US 20110167414A1
• Time in Patent Office: 1,492 Days
• Field of Search: None
• US Class Current: 717/140
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 8/70 Software maintenance or management

Abstract

Disclosed herein are systems, methods, and computer-readable storage media for obfuscating by a common function. A system configured to practice the method identifies a set of functions in source code, generates a transformed set of functions by transforming each function of the set of functions to accept a uniform set of arguments and return a uniform type, and merges the transformed set of functions into a single recursive function. The single recursive function can allocate memory in the heap. The stack can contain a pointer to the allocated memory in the heap. The single recursive function can include instructions for creating and explicitly managing a virtual stack in the heap. The virtual stack can emulate what would happen to the real stack if one of the set of functions was called. The system can further compile the source code including the single recursive function.

Claims

1. A computer-implemented method of obfuscating by a common function, the method causing a computing device to perform steps comprising:

identifying a set of functions in source code;

generating a transformed set of functions by transforming each function of the set of functions to accept a uniform set of arguments and return a uniform type;

merging the transformed set of functions into a single recursive function;

eliminating references to a stack; and

translating recursive function calls to push a virtual stack.

2. The computer-implemented method of claim 1, wherein the single recursive function allocates memory in a heap.

3. The computer-implemented method of claim 2, wherein the stack contains a pointer to the allocated memory in the heap.

4. The computer-implemented method of claim 2, wherein the single recursive function creates the virtual stack in the heap.

5. The computer-implemented method of claim 4, the method further causing the computing device to explicitly manage the virtual stack by pushing variables on to and popping variables off from the virtual stack.

6. The computer-implemented method of claim 1, wherein transforming each function comprises:

creating a structure type for each function of the set of functions, wherein the structure contains an element for each parameter passed to the function and an element for the return type of the function; and

modifying each function of the set of functions so that the functions in the set share the same return type and the same parameter type, wherein the parameter type is the structure type or a pointer to the structure type.

7. A system for converting source code having a set of functions, the system comprising:

a processor;

a module controlling the processor to identify a set of functions in source code;

a module controlling the processor to generate a transformed set of functions by transforming each function of the set of functions to accept a uniform set of arguments and return a uniform type;

a module controlling the processor to merge the transformed set of functions into a single large function; and

a module controlling the processor to replace calls to each of the identified set of functions with a corresponding call to the single large function,

wherein one argument in the uniform set of arguments indicates a function within the set of functions to be executed.

8. The system of claim 7, wherein the single large function accepts a single argument having a structure type, wherein the structure type contains an element for each argument of each function in the identified set of functions.

9. The system of claim 7, wherein the single large function is recursive.

10. A system for converting source code having a set of functions, the system comprising:

a processor;

a module controlling the processor to identify a set of functions in source code;

a module controlling the processor to generate a transformed set of functions by transforming each function of the set of functions to accept a uniform set of arguments and return a uniform type;

a module controlling the processor to merge the transformed set of functions into a single large function;

a module controlling the processor to replace calls to each of the identified set of functions with a corresponding call to the single large function; and

a module controlling the processor to replace function calls in the source code with a jump instruction to a specific location within the single large function.

11. A computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to execute certain steps, the instructions recursively accessing a common function created by steps comprising:

identifying a set of functions in source code;

transforming each function of the set of functions to have a uniform set of arguments and a uniform return value; and

merging the set of functions into a common function,

wherein the instructions contain multiple embedded common functions.

12. The computer-readable storage medium of claim 11, wherein the common function is embedded in the instructions.

13. The computer-readable storage medium of claim 11, wherein the common function is stored separately from the instructions.

14. A system for obfuscating source code by a common function, the system comprising:

a processor;

a module that controls the processor to identify a set of functions in source code;

a module that controls the processor to generate a transformed set of functions by transforming each function of the set of functions to accept a uniform set of arguments and return a uniform type;

a module that controls the processor to merge the transformed set of functions into a single large function; and

a module that controls the processor to replace function calls in the source code with a jump instruction to a specific location within the single large function.

15. The system of claim 14, wherein one argument in the uniform set of arguments indicates a function within the set of functions to be executed.

16. The system of claim 14, wherein function calls to one of the set of functions include direct and indirect calls.

17. The system of claim 14, wherein the single large function is recursive.