Binary Tree Branch Obfuscation for Software Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hash table based branch function obfuscation techniques in software protection are impractical due to storage and computational constraints, as they require storing key-value pairs, which can be easily discovered by attackers, and are specific to each data set, making them costly and inefficient.
Innovation Solution
The use of a binary tree structure to store destination information, where internal nodes are constants and leaf nodes are destination values, allowing traversal by return address without storing return addresses, and a hybrid approach combining hash tables and trees to balance access time and storage efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a traditional hash table is used to store return address and destination value pairs, then the branch function can quickly resolve destination addresses, but the key-value pairs are easily discovered by attackers, reducing obfuscation effectiveness
Solution Approach 1:
The patent extracts and removes the return address keys from the data structure, keeping only the destination value information in the tree. This extraction principle eliminates the harmful factor of key exposure while preserving the lookup functionality through tree traversal based on return address comparison.
Solution Approach 2:
The patent introduces an intermediary tree structure that mediates between the return address and destination value. Instead of directly storing key-value pairs, the tree serves as an intermediary that enables indirect lookup by comparing return addresses with node values during traversal, thereby protecting the actual destination mappings.
2Reliability
If a perfect hash function is used to eliminate collisions and improve lookup reliability, then each key hashes to a unique table index, but the cost, storage space, and computing power requirements increase significantly
Solution Approach 1:
The patent replaces the expensive perfect hash function with a simpler, less resource-intensive tree structure. The tree uses basic comparison operations during traversal that require minimal computational resources and storage space, effectively using a cheaper alternative to achieve the same lookup reliability without the overhead of perfect hashing.
3Measurement precision
If a perfect hash function is generated for each unique data set, then lookup accuracy is maximized, but the recalculation cost for each data set becomes prohibitively expensive
Solution Approach 1:
The patent performs preliminary organization of data into a tree structure during compilation, where the tree is constructed once with all destination mappings. This preliminary action eliminates the need for recalculation with each data set, as the tree structure can handle different return addresses through its traversal mechanism without requiring regeneration.
4Manufacturing precision
If the branch function is modified to use a perfect hash function, then destination address computation becomes more accurate, but the modification may not always be possible due to implementation constraints
Solution Approach 1:
The patent creates a universal tree-based solution that can be applied across different implementations without modification. The tree structure serves multiple functions: it enables lookup for any return address, handles collisions naturally through traversal, and works with various data sets without requiring changes to the underlying mechanism, thereby providing both precision and adaptability.
Data Source
AI summary
Disclosed herein are systems, methods, and non-transitory computer-readable storage media for obfuscating branches in computer code. A compiler or a post-compilation tool can obfuscate branches by receiving source code, and compiling the source code to yield computer-executable code. The compiler identifies branches in the computer-executable code, and determines a return address and a destination value for each branch. Then, based on the return address and the destination value for each branch, the compiler constructs a binary tree with nodes and leaf nodes, each node storing a balanced value, and each leaf node storing a destination value. The non-leaf nodes are arranged such that searching the binary tree by return address leads to a corresponding destination value. Then the compiler inserts the binary tree in the computer-executable code and replaces each branch with instructions in the computer-executable code for performing a branching operation based on the binary tree.