OBFUSCATION EVALUATION METHOD AND OBFUSCATION METHOD

• US 20090119515A1
• Filed: 10/27/2006
• Published: 05/07/2009
• Est. Priority Date: 10/28/2005
• Status: Active Grant

• Current Assignee: Sovereign Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Matsushita Electric Industrial Company Limited (Panasonic Holdings Corporation)
• Inventors: Nicolson, Kenneth Alexander, Sato, Taichi, Asai, Rieko
• Granted Patent: US 8,108,689 B2
• Time in Patent Office: Days
• US Class Current: 713/190
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation

Abstract

An obfuscation evaluation method which sufficiently evaluates an obfuscation performed on a program. The obfuscation evaluation method includes: a step (S424) of executing an obfuscated code module (204) produced by obfuscating an original code module (200) of a program, and generating a trace output file (218) by logging a result of the execution; and a step (S428) of identifying the degree of obfuscation of the obfuscated code module (204) by evaluating the trace output file (218).

Claims

1. An obfuscation evaluation method for evaluating an obfuscation performed on a program, comprising:

a first execution step of executing an obfuscated code generated by obfuscating original code of the program;

a first logging step of generating first logging data by logging execution details of said first execution step; and

an evaluation step of evaluating the first logging data, thereby identifying the degree of obfuscation of the obfuscated code.

2. The obfuscation evaluation method according to claim 1,

wherein in said evaluation step, a numerical value, which is an indicator of the degree of obfuscation, is calculated as a metric, based on the first logging data.

3. The obfuscation evaluation method according to claim 2, further comprising:

a second execution step of executing the original code; and

a second logging step of generating second logging data by logging execution details of said second execution step,

wherein in said evaluation step, the first logging data is compared with the second logging data and evaluated based on the comparison.

4. The obfuscation evaluation method according to claim 3,

wherein the obfuscated code is produced by obfuscating each of fundamental blocks present in the original code, per fundamental block, and

in said evaluation step, the first logging data is evaluated per corresponding fundamental block using block mapping information, which indicates a correspondence between a fundamental block of the original code and a fundamental block of the obfuscated code.

5. The obfuscation evaluation method according to claim 4,

wherein in said evaluation step, the number of executed paths indicated in the first logging data is compared to the number of executed paths indicated in the second logging data, and the comparison result is calculated as the metric.

6. The obfuscation evaluation method according to claim 5,

wherein in said evaluation step, the ratio between the number of executed paths indicated in the first logging data and the number of executed paths indicated in the second logging data is calculated as the metric.

7. The obfuscation evaluation method according to claim 4,

wherein in said evaluation step, the degree of change between path coverage indicated in the first logging data and path coverage indicated in the second logging data is calculated as the metric.

8. The obfuscation evaluation method according to claim 7,

wherein in said evaluation step, the ratio between the path coverage indicated in the first logging data and the path coverage indicated in the second logging data is calculated as the metric.

9. The obfuscation evaluation method according to claim 4,

wherein in said evaluation step, a degree of similarity between the first logging data and the second logging data is calculated as the metric.

10. The obfuscation evaluation method according to claim 9,

wherein in said evaluation step, the degree to which the first logging data and the second logging data resemble one another is expressed as a Levenshtein distance.

11. The obfuscation evaluation method according to claim 3,

wherein in said evaluation step, a frequency distribution of executed paths within the path coverage according to the first logging data is calculated as the metric.

12. The obfuscation evaluation method according to claim 11,

wherein in said evaluation step, a chi-square result of an Equidistribution Test of path coverage is calculated as the metric.

13. The obfuscation evaluation method according to claim 11,

wherein in said evaluation step, a chi-square result of a Poker Test of path coverage is calculated as the metric.

14. The obfuscation evaluation method according to claim 2, further comprising:

a third execution step of executing an other obfuscated code generated by obfuscating the original code using a method which is different from a method used for the obfuscated code; and

a third logging step of generating third logging data by logging execution details of said third execution step,

wherein in said evaluation step, the first logging data is compared with the third logging data and evaluated based on the comparison.

15. An obfuscation method for obfuscating a program, comprising:

an obfuscation step of generating an obfuscated code by obfuscating the original code of the program;

a first execution step of executing the obfuscated code generated in said obfuscation step;

a first logging step of generating first logging data by logging execution details of said first execution step;

an evaluation step of evaluating the first logging data, thereby identifying the degree of obfuscation of the obfuscated code; and

a re-obfuscation step of re-obfuscating the original code based on a result of the evaluation performed in said evaluation step.

16. The obfuscation method according to claim 15, further comprising:

a second execution step of executing the original code; and

a second logging step of generating second logging data by logging execution details of said second execution step,

wherein in said evaluation step, the first logging data is compared with the second logging data and evaluated.

17. The obfuscation method according to claim 16,

wherein in said obfuscation step, fundamental blocks present in the original code are obfuscated and block mapping information produced, the block mapping information indicating a correspondence between the fundamental blocks of the original code and the fundamental blocks of the obfuscated code, and

in said evaluation step, the first logging data is evaluated per corresponding fundamental block using the block mapping information.

18. The obfuscation method according to claim 17,

wherein in said re-obfuscation step, a block of the original code is selected based on a result of the evaluation in said evaluation step, and the selected block is re-obfuscated.

19. The obfuscation method according to claim 15,

wherein in said obfuscation step, control information that includes obfuscation parameters is used, and the original code is obfuscated in accordance with the parameters.

20. The obfuscation method according to claim 15,

wherein in said evaluation step, evaluation result data, which indicates a result of evaluating the first logging data, is generated in a format that is readable in said re-obfuscation step.

21. The obfuscation method according to claim 15,

wherein in said evaluation step, evaluation result data, which indicates a result of evaluating the first logging data, is generated, and the format of the evaluation result data is converted into a format that is readable in said re-obfuscation step.

22. The obfuscation method according to claim 15,

wherein in said evaluation step, a numerical value, which is an indicator of the degree of obfuscation, is calculated as a metric, based on the first logging data.

23. The obfuscation method according to claim 22, further comprising

a metric judgment step of judging whether or not the metric calculated in said evaluation step is within a permissible range,

wherein each time the metric is judged as not being within the permissible range in said metric judgment step, a new obfuscated code is generated by re-obfuscating the original code in said re-obfuscation step, and said first execution step, said first logging step, said evaluation step, and said metric judgment step are repeated for the new obfuscated code, and

when the metric is judged as being within the permissible range in said metric judgment step, the original code is not re-obfuscated in said re-obfuscation step.

24. The obfuscation method according to claim 23,

wherein in said evaluation step, an average value of plural numerical values, which are indicators of the degree of obfuscation, is calculated as the metric, based on the first logging data.

25. The obfuscation method according to claim 23,

wherein in said evaluation step, plural numerical values, which are indicators of the degree of obfuscation, are weighted, and an average of the weighted plural numerical values is calculated as the metric, based on the first logging data.

26. The obfuscation method according to claim 15, further comprising

a number judgment step of judging whether or not the number of times obfuscation has been performed on the original code has exceeded a pre-set number of times,

wherein each time it is judged that the pre-set number of times has not been exceeded in said number judgment step, a new obfuscated code is generated by re-obfuscating the original code in said re-obfuscation step, and said first execution step, said first logging step, said evaluation step, and said number judgment step are repeated for the new obfuscated code, and

when it is judged that the pre-set number of times has been exceeded in said number judgment step, the original code is not re-obfuscated in said re-obfuscation step.

27. The obfuscation method according to claim 15, further comprising

a time judgment step of judging whether or not the amount of time required for performing obfuscation on the original code has exceeded a pre-set amount of time,

wherein each time it is judged that the pre-set amount of time has not been exceeded in said time judgment step, a new obfuscated code is generated by re-obfuscating the original code in said re-obfuscation step, and said first execution step, said first logging step, said evaluation step, and said time judgment step are repeated for the new obfuscated code, and

when it is judged that the pre-set amount of time has been exceeded in said time judgment step, the original code is not re-obfuscated in said re-obfuscation step.

28. The obfuscation method according to claim 15,

wherein said first execution step, said first logging step, and said evaluation step are repeated for a new obfuscated code generated by the re-obfuscating in said re-obfuscation step, and

said obfuscation method further comprises

a continuance step of comparing a degree of obfuscation identified in an immediately preceding evaluation step with a degree of obfuscation identified in an obfuscation step ahead of said immediately preceding evaluation step, and repeating said steps from said re-obfuscation step, based on the a result of the comparison.

29. An obfuscation evaluation apparatus for evaluating an obfuscation performed on a program, comprising:

an execution unit operable to execute an obfuscated code generated by obfuscating original code of the program;

a logging unit operable to generate logging data by logging execution details of said execution unit; and

an evaluation unit operable to evaluate the logging data, thereby identifying the degree of obfuscation of the obfuscated code.

30. An obfuscation apparatus for obfuscating a program, comprising:

an obfuscation unit operable to generate an obfuscated code by obfuscating the original code of the program;

an execution unit operable to execute the obfuscated code generated by said obfuscation unit;

a logging unit operable to generate logging data by logging execution details of said execution unit;

an evaluation unit operable to evaluate the logging data, thereby identifying the degree of obfuscation of the obfuscated code; and

a re-obfuscation unit operable to re-obfuscate the original code based on a result of the evaluation performed by said evaluation unit.

31. An obfuscation evaluation program for evaluating an obfuscation performed on a program, said obfuscation evaluation program causing a computer to execute:

a first execution step of executing an obfuscated code generated by obfuscating original code of the program;

a first logging step of generating first logging data by logging execution details of said first execution step; and

an evaluation step of evaluating the first logging data, thereby identifying the degree of obfuscation of the obfuscated code.

32. An obfuscation program for obfuscating a program, said obfuscation program causing a computer to execute:

an obfuscation step of generating an obfuscated code by obfuscating the original code of the program;

a first execution step of executing the obfuscated code generated in said obfuscation step;

a first logging step of generating first logging data by logging execution details of said first execution step;

an evaluation step of evaluating the first logging data, thereby identifying the degree of obfuscation of the obfuscated code; and

a re-obfuscation step of re-obfuscating the original code based on a result of the evaluation performed in said evaluation step.

33. A storage medium in which an obfuscation evaluation program for evaluating an obfuscation performed on a program is stored,

wherein said obfuscation evaluation program causes a computer to execute:

an execution step of executing an obfuscated code generated by obfuscating original code of the program;

a logging step of generating logging data by logging execution details of said execution step; and

an evaluation step of evaluating the logging data, thereby identifying the degree of obfuscation of the obfuscated code.

34. A storage medium in which an obfuscation program for obfuscating a program is stored,

wherein said obfuscation program causes a computer to execute:

an obfuscation step of generating an obfuscated code by obfuscating the original code of the program;

an execution step of executing the obfuscated code generated in said obfuscation step;

a logging step of generating logging data by logging execution details of said execution step;

an evaluation step of evaluating the logging data, thereby identifying the degree of obfuscation of the obfuscated code; and

a re-obfuscation step of re-obfuscating the original code based on a result of the evaluation performed in said evaluation step.

35. An integrated circuit for evaluating an obfuscation performed on a program, comprising:

an execution unit operable to execute an obfuscated code generated by obfuscating original code of the program;

a logging unit operable to generate logging data by logging execution details of said execution unit; and

an evaluation unit operable to evaluate the logging data, thereby identifying the degree of obfuscation of the obfuscated code.

36. An integrated circuit for obfuscating a program, comprising:

an obfuscation unit operable to generate an obfuscated code by obfuscating the original code of the program;

an execution unit operable to execute the obfuscated code generated by said obfuscation unit;

a logging unit operable to generate logging data by logging execution details of said execution unit;

an evaluation unit operable to evaluate the logging data, thereby identifying the degree of obfuscation of the obfuscated code; and

a re-obfuscation unit operable to re-obfuscate the original code based on a result of the evaluation performed by said evaluation unit.