Method for preventing software reverse engineering, unauthorized modification, and runtime data interception

• US 8,938,727 B2
• Filed: 01/07/2013
• Issued: 01/20/2015
• Est. Priority Date: 08/06/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Asipov, Keren, Asipov, Boris
• Primary Examiner(s): Chen, Qing
• Application Number:
  US13/735,849
• Publication Number:
  US 20130125243A1
• Time in Patent Office: 743 Days
• Field of Search: 717139-161, 726 26- 33
• US Class Current: 717/148
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 9/45504 Abstract machines for programme code execution, e.g. Java virtual machine [JVM], interpreters, emulators

Abstract

A method for preventing the unauthorized modification of a software or unauthorized modification of runtime data. According to this method, a converter, which is capable of converting the software into a generalized machine code is provided. The converter is designed such that it cannot he reverse engineered, by using a conversion process that causes data loss. An interpreter, which the knowledge of its process method is kept restricted, is also provided. The interpreter interprets the general machine code into a specific machine code, while reconstructing the lost data during the interpretation process.

Claims

1. A method for preventing unauthorized modification of a software or unauthorized modification of runtime data, comprising:

providing a converter capable of converting the software into a generalized machine code, that cannot be reverse engineered, by using a conversion process that causes data loss;

providing an interpreter, wherein knowledge of the interpreter'"'"'s process method is kept restricted, wherein the interpreter is implemented as an interpreter-based programming language software component for maintaining the same level of portability as the software, and wherein the interpreter is formed by choosing a complete instruction subset out of a redundant instruction set, and by dynamically generating the converter and the interpreter implementation; and

interpreting, by the interpreter, the generalized machine code into a specific machine code while reconstructing the data lost during the conversion process.

2. The method of claim 1, wherein the interpreter is compiled by a Common Language Runtime (CLR).

3. The method of claim 1, wherein the software is divided such that a portion of the software is converted by the converter and interpreted by the interpreter.

4. The method of claim 1, wherein the software is implemented using a high level programming language.

5. The method of claim 4, wherein the high level programming language is an interpreter-based programming language.

6. The method of claim 5, wherein the high level programming language is any one of the following:

Java, Visual J#, J#, C#, or Visual Basic.NET.

7. The method of claim 4, wherein the high level programming language is a compiler-based programming language.

8. The method of claim 7, wherein the high level programming language is any one of the following:

C++, Visual Basic, or Pascal.

9. The method of claim 1, wherein the data lost during the conversion process comprises code structure metadata removed during the conversion process.

10. The method of claim 1, wherein the data lost during the conversion process is a conversion of instructions to other instructions which their corresponding operand(s) is determined during runtime.

11. A computer-readable medium, excluding signals, storing executable instructions that, when executed by a processor, prevent unauthorized modification of a software or unauthorized modification of runtime data, the computer-readable medium storing the executable instructions executable by the processor to:

provide a converter capable of converting the software into a generalized machine code, that cannot be reverse engineered, by using a conversion process that causes data loss;

provide an interpreter, wherein knowledge of the interpreter'"'"'s process method is kept restricted, wherein the interpreter is implemented as an interpreter-based programming language software component for maintaining the same level of portability as the software, and wherein the interpreter is formed by choosing a complete instruction subset out of a redundant instruction set, and by dynamically generating the converter and the interpreter implementation; and

interpret, by the interpreter, the generalized machine code into a specific machine code while reconstructing the data lost during the conversion process.

12. The computer-readable medium of claim 11, wherein the interpreter is compiled by a Common Language Runtime (CLR).

13. The computer-readable medium of claim 11, wherein the software is divided such that a portion of the software is converted by the converter and interpreted by the interpreter.

14. The computer-readable medium of claim 11, wherein the software is implemented using a high level programming language.

15. The computer-readable medium of claim 14, wherein the high level programming language is an interpreter-based programming language.

16. The computer-readable medium of claim 14, wherein the high level programming language is a compiler-based programming language.

17. The computer-readable medium of claim 14, wherein the high level programming language is any one of the following:

Java, Visual J#, J#, C#, C++, Visual Basic, Visual Basic.NET, or Pascal.

18. The computer-readable medium of claim 11, wherein the data lost during the conversion process comprises code structure metadata removed during the conversion process.

19. The computer-readable medium of claim 11, wherein the data lost during the conversion process is a conversion of instructions to other instructions which their corresponding operand(s) is determined during runtime.