Obfuscating Program Control Flow via Data Extraction

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional obfuscation techniques fail to effectively hide control flow in computer programs, making them vulnerable to tampering and reverse engineering, as control flow statements remain accessible in source code and cannot be changed after deployment.

Innovation Solution

The control flow of a computer program is encoded into a modified Petri Net and represented as data, allowing it to be executed at runtime, thereby removing control flow statements from the source code and enabling dynamic modification, which can occur locally or remotely.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If control flow statements are kept in source code for program execution, then the program can execute correctly, but the control flow becomes accessible and vulnerable to reverse engineering and tampering

Engineering Contradiction:

Improveprogram execution correctnessVSAvoidvulnerability to reverse engineering

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts control flow information from the source code and represents it as separate data structures (stack, queue, linked list, or array). This separation removes the control flow statements from the executable code, making them inaccessible for reverse engineering while preserving program execution through the use of these extracted control flow data structures during runtime.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces an intermediary mechanism that separates control flow representation from executable code. The control flow is represented as data structures that mediate between the source code and the execution engine, allowing the program to execute correctly while preventing direct access to control flow statements for tampering or reverse engineering.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If conventional obfuscation techniques are applied to hide control flow, then code becomes more confusing, but control flow statements remain accessible in source code and can be uncovered

Engineering Contradiction:

Improvedifficulty to identify control flowVSAvoidprotection effectiveness

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent completely removes control flow statements from the source code by extracting them into separate data structures. This goes beyond conventional obfuscation by not just hiding control flow but physically separating it from the executable code, making it impossible for attackers to access or modify control flow statements through source code analysis.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent replaces the traditional mechanical representation of control flow (statements embedded in source code) with a data-driven approach. Control flow is represented as data structures that are processed at runtime, substituting the conventional source code-based control flow mechanism with a more secure data-centric approach that prevents reverse engineering.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Stability of the object's composition

If control flow is represented as fixed asset in source code, then program structure is stable, but control flow cannot be modified after deployment

Engineering Contradiction:

Improveprogram structure stabilityVSAvoidability to modify control flow

Core Design Contradiction:

Stability of the object's compositionVSAdaptability or versatility

Solution Approach 1:

The patent transforms control flow from a static, fixed asset in source code to a dynamic data structure that can be modified at runtime. By representing control flow as mutable data structures (stack, queue, linked list, or array), the system enables dynamic modification of control flow after deployment while maintaining program structure stability through the separation of code and control flow data.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentEP3918494B1Systems, methods, and storage media for obfuscating a computer program by representing the control flow of the computer program as data

Publication Date: 2023.10.11 IRDETO BV

Figure 1
Figure 2
Figure 3

AI summary

Systems, methods, and storage media for obfuscating a computer program by representing the control flow of the computer program as data that is not source code are disclosed. Exemplary implementations may: receive source code of a computer program; parse the source code; extract the control flow of the source code; represent at least a portion of the control flow as a control flow model using a mathematical modeling language; store the control flow model as control flow data that represents the control flow of the program and is not executable code; and remove the at least a portion of the control flow from the source code, to thereby obfuscate the control flow of the source code and render the source code more resistant to tampering.