Compile based obfuscation

• US 9,471,288 B2
• Filed: 08/05/2015
• Issued: 10/18/2016
• Est. Priority Date: 02/28/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Miller, Olaf Alexander, Tzen, Ten, Bostanci, Hakki T., Pashniak, Michael T., Patel, Kalpesh S.
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): Wang, Ben C
• Application Number:
  US14/818,538
• Publication Number:
  US 20150339108A1
• Time in Patent Office: 440 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/423 Preprocessors
• CPC Class Codes: G06F 8/4442 Reducing the number of cache misses; Data prefetching cache prefetching G06F12/0862
• CPC Class Codes: G06F 8/445 Exploiting fine grain parallelism, i.e. parallelism at instruction level run-time instruction scheduling G06F9/3836
• CPC Class Codes: G06F 8/47 Retargetable compilers
• CPC Class Codes: G06F 8/51 Source to source
• CPC Class Codes: G06F 8/52 Binary to binary
• CPC Class Codes: G06F 8/70 Software maintenance or management

Abstract

Compiler based obfuscation is described. To protect portions of a code project with obfuscations, the code is modified within a compiler to produce one or more modifications that obfuscate the code as part of a compilation process. A compiled version of the code is generated having the modifications that are produced within the compiler. In one approach, the compiler is configured to consume an obfuscation description that indicates portions of the code to protect and specifies the modifications to make to the indicated portions. Various different modifications of code may be performed during the compilation process to implement corresponding obfuscation features. For example, the modifications made within a compiler may include, but are not limited to, modifications designed to enable tamper detection, anti-debugging, and/or encryption of the code.

Claims

1. A method implemented by a computing device to obfuscate source code as part of compilation of source code by a compiler comprising:

obtaining an obfuscation description file having directives that specify modifications supported by the compiler to make as part of compilation of the source code to obfuscate one or more portions of the source code, the modifications supported by the compiler including at least one of;

rearranging of code blocks or modules, call redirection, creation of a clone function, applying obfuscation algorithms, changes to symbol attributes and behaviors, segmenting of code blocks, replacing calls, setting absolute references between different portions of the code, addition of jump instructions, encryption of code portions, or modification of entry points into the code;

generating obfuscation source code having instructions derived from the obfuscation description file to implement the directives as part of compilation;

combining the obfuscation source code and source code into a combined code file; and

compiling the combined code file to produce protected compiled code, the compiling including producing the modifications by applying the obfuscation source code included in the combined code file to obfuscate the one or more portions of the source code as specified by the directives.

2. The method as recited in claim 1, wherein the obfuscation description file is configured to define different types of modifications, obfuscation algorithms, settings, and parameters that the compiler is configured to interpret and apply during compilation to effectuate the modifications.

3. The method as recited in claim 2, further comprising generating one or more obfuscation algorithms specified by the directives on the fly to produce the modifications as part of the compiling.

4. The method as recited in claim 3, wherein different obfuscation algorithms are generated for and applied to at least two different portions of the code.

5. The method as recited in claim 1, further comprising:

modifying multiple portions of the code as part of compilation of the code including applying different obfuscation features and modifications on an individual basis to the multiple portions as specified by the directives to individualize protection of the multiple portions.

6. The method as recited in claim 1, wherein compiling the combined code to produce protected compiled code producing compiled binary files having the modifications to obfuscate portions of the protected compiled code.

7. The method as recited in claim 1, wherein the compiler is implemented as a component of an integrated development environment (IDE).

8. The method as recited in claim 1, wherein the modifications are designed to enable one or more of heap execution, verification, encryption of the code, or virtualization of at least one function to run in an obfuscated form at runtime.

9. A system comprising:

one or more computing devices;

one or more modules stored in memory of the one or more computing devices and operable via the or more computing devices to implement a compiler configured to perform operations to obfuscate source code as part of compilation of the source code including;

obtaining by the compiler an obfuscation description file having directives that specify modifications to make as part of compilation of source code to obfuscate one or more portions of the source code;

generating obfuscation source code having instructions derived from the obfuscation description file to implement the directives as part of compilation;

combining the obfuscation source code and source code into a combined code file; and

compiling the combined code file to produce protected compiled code, the compiling including producing the modifications by applying the obfuscation source code included in the combined code file to obfuscate the one or more portions of the source code as specified by the directives, the modifications including one or more of;

rearranging of code blocks or modules, call redirection, creation of a clone function, applying obfuscation algorithms, changes to symbol attributes and behaviors, segmenting of code blocks, replacing calls, setting absolute references between different portions of the code, addition of jump instructions, encryption of code portions, or modification of entry points into the code.

10. The system as recited in claim 9, wherein the obfuscation description file is configured to define different types of modifications, obfuscation algorithms, settings, and parameters that the compiler is configured to interpret and apply during compilation to effectuate the modifications.

11. The system as recited in claim 10, wherein the operations to obfuscate source code further comprise generating one or more obfuscation algorithms specified by the directives on the fly to produce the modifications as part of the compiling.

12. The system as recited in claim 11, wherein different obfuscation algorithms are generated for and applied to at least two different portions of the code.

13. The system as recited in claim 9, wherein the operations to obfuscate source code further comprise:

modifying multiple portions of the code as part of compilation of the code including applying different obfuscation features and modifications on an individual basis to the multiple portions as specified by the directives to individualize protection of the multiple portions.

14. The system as recited in claim 9, wherein compiling the combined code to produce protected compiled code includes producing compiled binary files having the modifications to obfuscate portions of the protected compiled code.

15. The system as recited in claim 9, wherein the compiler is implemented as a component of an integrated development environment (IDE).

16. The system as recited in claim 9, wherein the modifications are designed to enable one or more of heap execution, verification, encryption of the code, or virtualization of at least one function to run in an obfuscated form at runtime.

17. One or more computer-readable storage media storing instructions that, when executed by a computing device, implement a compiler module configured to perform operations comprising:

obtaining an obfuscation description file having directives that specify modifications to make as part of compilation of the source code to obfuscate one or more portions of the source code;

generating obfuscation source code having instructions derived from the obfuscation description file to implement the directives as part of compilation;

combining the obfuscation source code and source code into a combined code file; and

compiling the combined code file to produce protected compiled code, the compiling including producing the modifications by applying the obfuscation source code included in the combined code file to obfuscate the one or more portions of the source code as specified by the directives, the modifications including at least one of;

rearranging of code blocks or modules, call redirection, creation of a clone function, applying obfuscation algorithms, changes to symbol attributes and behaviors, segmenting of code blocks, replacing calls, setting absolute references between different portions of the code, addition of jump instructions, encryption of code portions, or modification of entry points into the code.

18. One or more computer-readable storage media as described in claim 17, wherein compiling the combined code includes:

passing configuration information indicated by the obfuscation source code to an obfuscation module during compilation; and

receiving instructions from the obfuscation module configured to cause the compiler module to make the modifications.

19. One or more computer-readable storage media as described in claim 17, wherein the compiler module is implemented as a component of an integrated development environment (IDE) including an obfuscation module and the compiler module, the obfuscation module operable to produce the obfuscation description file and supply the obfuscation description file for consumption by the compiler module, the compiler module operable to compile the source code to produce the protected compiled code including obtaining and interpreting the obfuscation description file supplied by the obfuscation module to implement corresponding modifications of the source code during compilation.

20. One or more computer-readable storage media as described in claim 17, wherein the obfuscation description file is configured to define different types of modifications, obfuscation algorithms, settings, and parameters that the compiler module is configured to interpret and apply during compilation to effectuate the modifications.