Code Obfuscation via Input Space Segmentation and Dynamic Path Selection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for protecting computer programs from analysis and vulnerability detection are insufficient, as they do not provide adequate protection against external analysis, whether by humans or automated software.

Innovation Solution

A method of obfuscating computer code by segmenting the input space into different segments based on input data, using selection code to choose updated code blocks and transition code to change the execution path, making it difficult for analyzers to identify vulnerabilities and interpret the program structure.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the program structure is kept simple and clear, then it is easy to understand and maintain, but it becomes easy for analyzers to identify vulnerabilities and interpret the program structure

Engineering Contradiction:

ImproveEase of understanding and maintaining program structureVSAvoidVulnerability detection by analyzers

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The program is divided into multiple code blocks with similar functionality, where each block represents a segment of the original execution path. The segmentation creates multiple alternative paths that lead to the same result, making it difficult for analyzers to identify the correct vulnerability-free path while maintaining the original program's functional structure

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The program uses a mode variable that changes between normal mode and neutral mode to control execution flow. In normal mode, the program executes original instructions; in neutral mode, it executes obfuscating instructions that consume resources without producing meaningful output. This parameter-based control transforms the execution behavior dynamically

Inventive Principle:

Principle #35Parameter changes

2Object-affected harmful factors

If obfuscation techniques are applied to protect the program, then vulnerability detection becomes more difficult, but the program structure becomes more complex and harder to maintain

Engineering Contradiction:

ImproveProtection against vulnerability analysisVSAvoidProgram structure complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

Multiple copies of code blocks are created, where each copy contains similar or identical functionality. These copies serve as obfuscating elements that mimic the real execution path but ultimately lead to neutral operations. The copying technique increases structural complexity while providing effective protection against analysis

Inventive Principle:

Principle #26Copying

Solution Approach 2:

A dispatcher code block acts as an intermediary that selects which code block to execute next based on the current mode variable. This mediator layer adds complexity to the control flow by introducing an additional decision-making layer that obscures the direct relationship between input and execution path

Inventive Principle:

Principle #24Intermediary (Mediator)

3Difficulty of detecting and measuring

If multiple execution paths are introduced for obfuscation, then it becomes more difficult for analyzers to guess which branches are never used, but the execution time and resource consumption increase

Engineering Contradiction:

ImproveDifficulty for analyzers to identify dead codeVSAvoidExecution time and analyzer time

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of time

Solution Approach 1:

The program periodically switches between normal mode and neutral mode through the mode variable, creating a rhythmic pattern of useful and obfuscating operations. This periodic action ensures that analyzers cannot easily identify which paths are dead code, as all paths appear potentially valid, while the actual execution time increases due to the interleaved neutral operations

Inventive Principle:

Principle #19Periodic action

Data Source

PatentUS11783013B2Protected processing of operations

Publication Date: 2023.10.10 KONINKLIJKE PHILIPS NV

AI summary

A computer-implemented method of obfuscating a computer code comprises receiving (1201) an original computer program comprising a plurality of code blocks with computer instructions, the original computer program operable on input data within an input space, the original computer program operable to follow an execution path through the plurality of code blocks when receiving the input data, wherein the input space is segmented into at least one segment according to a segmentation, each segment comprising a subset of the input space containing inputs that correspond to a same execution path. A plurality of updated code blocks is included (1302) in the updated computer program. Selection code is operable 1303, during execution of the updated computer program, to select an updated code block of the plurality of updated code blocks in dependence on the input data. The selection code is included (1304) in the updated computer program.