Code Control Flow Obfuscation via Event Identifier Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing code obfuscation techniques are inadequate against sophisticated reverse engineering and tampering attacks, particularly in exposing the control flow of software applications.
Innovation Solution
A method involving the identification of functional blocks in code, associating random labels and event identifiers, and using a prologue and epilogue function to manage these identifiers, making static analysis more difficult.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional code obfuscation techniques (renaming variables, restructuring code) are used, then some level of protection against reverse engineering is achieved, but the control flow remains exposed to sophisticated attacks like dynamic analysis and control flow analysis
Solution Approach 1:
The code is divided into functional blocks with associated event identifiers. The control flow is segmented into discrete events that are registered in a prologue function, separating the control flow logic from the functional implementation. This segmentation makes it difficult for attackers to reconstruct the original control flow through traditional analysis methods.
Solution Approach 2:
Event identifiers serve as intermediaries between functional blocks, replacing direct control flow transitions. The prologue function acts as a mediator that registers and manages event identifiers, creating an additional layer of abstraction that obscures the actual control flow paths from static and dynamic analysis.
2Reliability
If control flow obfuscation techniques are implemented to enhance security, then protection against reverse engineering is improved, but the code complexity and analysis difficulty increase
Solution Approach 1:
The event identifier system serves multiple functions: it identifies functional blocks, manages control flow transitions, and provides obfuscation. The prologue function universally handles registration and management of all event identifiers throughout the program, reducing the need for separate control flow management mechanisms.
Solution Approach 2:
The control flow is transformed by changing the parameter representation from direct function calls and jumps to event identifier-based transitions. Functional blocks are associated with event identifiers that encode control flow information, changing the fundamental parameters of how control flow is represented and executed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
For obfuscating a code control flow a computer-implemented method comprises - identifying functional blocks in a code to be obfuscated; - associating a label to each functional block; - associating at least one event identifier with each functional block; - creating a prologue function configured to contain a registration for the at least one event identifier of each functional block; and - creating an epilogue function configured to contain a deregistration for the event identifier of each functional block.