Compile based obfuscation

• US 9,116,712 B2
• Filed: 02/28/2013
• Issued: 08/25/2015
• Est. Priority Date: 02/28/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Miller, Olaf Alexander, Tzen, Ten, Bostanci, Hakki T., Pashniak, Michael T., Patel, Kalpesh S.
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): Wang, Ben C
• Application Number:
  US13/781,691
• Publication Number:
  US 20140245271A1
• Time in Patent Office: 908 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/423 Preprocessors
• CPC Class Codes: G06F 8/4442 Reducing the number of cache misses; Data prefetching cache prefetching G06F12/0862
• CPC Class Codes: G06F 8/445 Exploiting fine grain parallelism, i.e. parallelism at instruction level run-time instruction scheduling G06F9/3836
• CPC Class Codes: G06F 8/47 Retargetable compilers
• CPC Class Codes: G06F 8/51 Source to source
• CPC Class Codes: G06F 8/52 Binary to binary
• CPC Class Codes: G06F 8/70 Software maintenance or management

Abstract

Compiler based obfuscation is described. To protect portions of a code project with obfuscations, the code is modified within a compiler to produce one or more modifications that obfuscate the code as part of a compilation process. A compiled version of the code is generated having the modifications that are produced within the compiler. In one approach, the compiler is configured to consume an obfuscation description that indicates portions of the code to protect and specifies the modifications to make to the indicated portions. Various different modifications of code may be performed during the compilation process to implement corresponding obfuscation features. For example, the modifications made within a compiler may include, but are not limited to, modifications designed to enable tamper detection, anti-debugging, and/or encryption of the code.

Claims

1. A method comprising:

modifying code for a development project within a compiler to produce one or more modifications to obfuscate a portion of the code as part of compilation of the code, including;

obtaining an obfuscation description having directives that define the modifications, the modifications designed to enable one or more of;

heap execution verification, or encryption of the code; and

producing the modifications by applying the obfuscation description to intermediate code that combines the code for the development project with code to implement the directives, the obfuscation description configured to designate portions of the code to obfuscate and modifications to make to the one or more portions; and

generating by the compiler a compiled version of the code having the modifications produced within the compiler to obfuscate the portion of code.

2. The method as recited in claim 1, further comprising generating one or more obfuscation algorithms on the fly as part of the compilation process to produce the modifications.

3. The method as recited in claim 2, wherein different obfuscation algorithms are generated for and applied to at least two different portions of the code.

4. The method as recited in claim 1, further comprising:

modifying multiple portions of the code as part of compilation of the code including applying different obfuscation features and modifications on an individual basis to the multiple portions as directed by the directives in the obfuscation description to individualize protection of the multiple portions.

5. The method as recited in claim 1, wherein generating the compiled version of the code comprises producing compiled binary files.

6. The method as recited in claim 1, wherein the modifications comprise at least one of rearranging of code blocks, call redirection, creation of a clone function, changes to symbol attributes and behaviors, segmenting of code blocks, replacing calls, setting absolute references between different portions of the code, or modification of entry points into the code.

7. The method as recited in claim 1, wherein the modifications comprise at least one of insertion of checksums, verifier modules, or verification code.

8. The method as recited in claim 1, wherein the modifications comprise encryption of the portion of code and addition of decryption/re-encryption code.

9. The method as recited in claim 1, wherein the modifications comprise virtualization of at least one function to run in an obfuscated form at runtime.

10. The method as recited in claim 1, wherein the modifying comprises:

pre-processing the code to produce intermediate language code that combines source code for the development project with source obfuscation code indicative of the modifications to make to the source code; and

obfuscating the code by applying the modifications to the intermediate language code within the compiler during compilation of the code.

11. One or more computer-readable storage media storing instructions that, when executed by a computing device, implement a compiler module configured to perform operations comprising:

obtaining directives indicative of portions of source code for a development project to protect and modifications to make to obfuscate the indicated portions, the modifications designed to enable one or more of heap execution, verification, or encryption of the source code;

generating intermediate language code that combines the source code with code to implement the directives; and

applying the directives to the intermediate language code to modify the indicated portions in accordance with the directives during compilation of the intermediate language code by the compiler module including modification of one or more functions to execute in an obfuscated form at runtime via a virtual execution environment that emulates operation of obfuscated instructions for the one or more functions.

12. One or more computer-readable storage media as described in claim 11, wherein applying the directives to the intermediate language code further comprises:

passing configuration information to an obfuscation module during compilation of the intermediate language code; and

receiving instructions from the obfuscation module configured to cause the compiler module to make the modifications.

13. One or more computer-readable storage media as described in claim 11, wherein the compiler module is further configured to perform operations comprising:

compiling obfuscated code produced by application of the directives to the intermediate language code; and

outputting protected compiled code for the development project having obfuscations produced during the compilation of the intermediate language code by the compiler module.

14. A computing device comprising:

a processing system;

one or more modules operable at least in part via hardware of the processing system to implement an integrated development environment (IDE) including;

a development module to expose a development interface to enable creation of source code for a software development project;

an obfuscation module to;

produce an obfuscation description produced through the development interface to specify modifications for a compiler to make during compilation of the source code to obfuscate one or more selected portions of the source code including applying different obfuscation features and modifications on an individual basis to the selected portions as directed by the obfuscation description to individualize protection of the selected portions;

associate the obfuscation description with the source code; and

supply the obfuscation description for consumption by the compiler module; and

a compiler module to compile the source code to produce protected compiled code for the development project using the obfuscation description to implement the specified modifications to obfuscate the one or more selected portions during compilation by interpreting and applying the obfuscation description supplied by the obfuscation module.

15. The computing device of claim 14, wherein the obfuscation module and the compiler module are implemented as integrated components of the integrated development environment (IDE).

16. The computing device of claim 14, wherein the integrated development environment (IDE) is configured as a web accessible service available to developers over a network.