Checksum-Based Code Integrity Protection via Chained Basic Blocks

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing code obfuscation techniques are ineffective in preventing reverse engineering, as attackers can detect and remove checksum calculations, allowing them to tamper with software code and disrupt its integrity.

Innovation Solution

Combining control flow flattening with checksum computations, where each basic block ends with a computation determining the next block's start address, and embedding initial checksum values in the code to create chains of checks that require simultaneous modification to tamper with the code, thereby ensuring the integrity of the next block is checked immediately before execution.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If code obfuscation techniques are used to conceal software logic, then reverse engineering difficulty increases, but attackers can still detect and remove checksum calculations to tamper with code integrity

Engineering Contradiction:
Improvereverse engineering difficultyVSAvoidcode integrity protection
Core Design Contradiction:
Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent divides the checksum verification process into multiple chained basic blocks, where each block's checksum is embedded in the next block. This segmentation creates multiple interdependent verification points that attackers must simultaneously compromise, significantly increasing the difficulty of undetected code tampering while maintaining code obfuscation.

Inventive Principle:
Principle #1Segmentation

2Reliability

If checksum calculations are embedded in each basic block to ensure integrity, then code tampering detection improves, but the code complexity and size increase

Engineering Contradiction:
Improvecode integrity protectionVSAvoidcode structure complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent merges the checksum calculation and verification logic directly into the control flow structure of basic blocks. By combining integrity verification with the existing control flow flattening approach, the patent achieves code protection without requiring separate verification mechanisms, thus limiting the increase in code complexity.

Inventive Principle:
Principle #5Merging (Combining)

3Difficulty of detecting and measuring

If control flow flattening is used to obfuscate execution flow, then reverse engineering becomes harder, but the next block calculation requires run-time information that may leak structure

Engineering Contradiction:
Improveexecution flow analysis difficultyVSAvoidcontrol flow structure information
Core Design Contradiction:
Difficulty of detecting and measuringVSLoss of information

Solution Approach 1:

The patent pre-calculates and embeds checksum values into the basic blocks during compilation, eliminating the need for run-time checksum calculations. This preliminary action ensures that integrity verification can proceed without exposing control flow structure through run-time computations, maintaining both obfuscation effectiveness and code integrity.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3035228B1Code integrity protection by computing target addresses from checksums
Publication Date: 2019.06.12 NXP BV
  • EP3035228B1 patent drawingFigure 1
  • EP3035228B1 patent drawingFigure 2
  • EP3035228B1 patent drawing

AI summary

A method of obscuring software code including a plurality of basic blocks, including: calculating, by a processor, a checksum value of the current basic block and a pointer to the end of the current basic block; determining a preceding basic block for the current basic block; inserting the checksum value for the current basic block into the preceding basic block; and inserting instructions into the preceding basic block to determine a pointer to the beginning of the current basic block based upon the checksum value of the current basic block.