Binary Recompilation Obfuscation for Resilient Executable Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional obfuscation techniques are fragile and sensitive to high-level languages and compiler build chains, requiring significant developer involvement and customization, making them vulnerable to adversarial analysis.

Innovation Solution

The Magic Shell facility analyzes and decompiles binaries to create a platform-specific Intermediate Representation, applies modular optimization and obfuscation techniques, and recompiles the code to generate a protected executable, incorporating platform-specific optimizations and distractions to enhance security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional obfuscation tools are used to protect binaries, then obfuscation is achieved, but the solution becomes fragile and sensitive to compiler build chains, requiring significant developer involvement

Engineering Contradiction:

Improveobfuscation reliabilityVSAvoidcomplexity of obfuscation process

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces an intermediary decompilation step that converts the binary into an intermediate representation before obfuscation. This intermediary form allows the obfuscation to be applied independently of the original compiler build chain, making the process more reliable and less complex while maintaining protection effectiveness

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent performs decompilation and intermediate representation generation as preliminary actions before applying obfuscation. This preliminary processing creates a platform-independent form that can be obfuscated without requiring knowledge of the original compiler chain, reducing the need for developer involvement and increasing reliability

Inventive Principle:

Principle #10Preliminary action

2Reliability

If conventional obfuscation techniques are applied, then binary protection is achieved, but the binaries become vulnerable to adversarial analysis

Engineering Contradiction:

Improvebinary protectionVSAvoidadversarial analysis vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

Instead of obfuscating compiled machine code directly (conventional approach), the patent inverts the process by first decompiling the binary into an intermediate representation, then applying obfuscation at this higher level. This inversion makes the code structure more resistant to adversarial analysis while maintaining protection

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent moves the obfuscation process from the machine code dimension to the intermediate representation dimension. This dimensional shift allows for more effective obfuscation that is harder for adversaries to analyze, as they would need to reverse the decompilation process to understand the original code structure

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

3Adaptability or versatility

If developer involvement is required for obfuscation customization, then obfuscation can be tailored, but the process becomes time-consuming and complex

Engineering Contradiction:

Improveobfuscation customizationVSAvoidtime for obfuscation process

Core Design Contradiction:

Adaptability or versatilityVSLoss of time

Solution Approach 1:

The patent implements a self-service obfuscation system where the decompilation and intermediate representation generation automatically adapts to different binaries without requiring manual developer configuration. The system handles customization through automated parameter adjustment in the intermediate representation, significantly reducing time while maintaining adaptability

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12481732B2Protection, obfuscation, and optimization of binary executables using recompilation

Publication Date: 2025.11.25 MAGIC SHELL SOFTWARE INC

AI summary

A facility for protecting executables is described. The facility accesses a first executable representation of a program and decompiles it to obtain an intermediate representation of the program. The facility obfuscates the intermediate representation of the program, and recompiles the obfuscated intermediate representation of the program to obtain a second executable representation of the program.