On-Demand Code Decryption via Object-to-Object Transformation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection methods are vulnerable to reverse engineering attacks due to encryption being performed at the linking stage, which requires coordination with multiple entities, increasing security risks and stability risks.
Innovation Solution
An object-to-object transformation process is implemented during the build process to encrypt and obscure code, replacing it with fake code, and storing it in a separate region of the object file, allowing on-demand decryption without relying on integrator coordination, thus enhancing security and reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is performed at the linking stage by the integrator, then code protection is achieved, but coordination with multiple entities increases security risks and stability risks
Solution Approach 1:
The patent extracts the encryption functionality from the integrator and relocates it to the compiler. The compiler now performs encryption during object code generation, eliminating the need for integrator coordination. This is achieved by having the compiler identify sensitive code sections, encrypt them, and store encrypted versions in the object file while keeping decryption logic within the same compilation pipeline.
Solution Approach 2:
The compiler serves itself by performing both compilation and encryption of code sections within the same process. The compiler generates object code, identifies sections requiring protection, encrypts them, and embeds the encrypted code back into the object file without requiring external integrator intervention. This self-service approach eliminates coordination complexity while maintaining protection reliability.
2Object-affected harmful factors
If on-demand decryption is implemented, then static analysis attacks are mitigated, but performance overhead is introduced due to decryption requirements
Solution Approach 1:
The patent segments code into protected and unprotected sections, encrypting only the sensitive portions. During execution, the decryption mechanism selectively decrypts only the encrypted sections when needed, rather than decrypting the entire program. This reduces performance overhead by limiting decryption to minimal necessary code segments.
Solution Approach 2:
The patent implements a mechanism where encrypted code is decrypted on-demand during execution and then re-encrypted or discarded after use. The decryption is temporary and localized to execution time, with the original encrypted form being restored or discarded afterward, minimizing the window of vulnerability and reducing overall performance impact.
3Reliability
If code is encrypted and stored in a separate region, then control over the obscuration process is maintained, but compatibility with relocation processes becomes challenging
Solution Approach 1:
The patent performs preliminary encryption of code sections during the compilation phase, before the linking and relocation processes occur. The compiler encrypts code sections and embeds encryption/decryption logic directly into the object file. This preliminary action ensures that the encrypted code maintains proper relocation compatibility because the encryption is performed with awareness of future relocation requirements, and decryption logic is pre-positioned to handle relocated addresses correctly.
Data Source
Figure 1
Figure 2A~3
Figure 4~5
AI summary
A system and a method for protecting code are provided. Extraction of code to be protected takes place during an object-to-object transformation and that code is replaced with fake binary code. The extracted code to be protected may then be encrypted or otherwise obscured and stored in a separate region of an object file. A prior source-to- source file transformation can be provided to isolate and mark the code to be protected, and to inject additional source code to handle later decryption.