Deobfuscating Stack Traces via Encrypted Mapping Logs

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Stack traces generated from obfuscated code are difficult to comprehend due to renamed function and variable names, hindering debugging and error identification.

Innovation Solution

A system that deobfuscates obfuscated stack traces by decrypting encrypted logs to map obfuscated code element names to deobfuscated names, generating mnemonic stack-trace hashes for easy identification and automatic notifications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If code is obfuscated to protect proprietary software, then software security is improved, but stack trace comprehensibility deteriorates

Engineering Contradiction:
Improvesoftware securityVSAvoidstack trace comprehensibility
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an obfuscation log as an intermediary data structure that maps obfuscated code element names to their original deobfuscated names. This log acts as a mediator between the obfuscated code execution and the stack trace generation, allowing stack traces to reference original meaningful names while the running code remains obfuscated and protected.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The obfuscation log is generated in advance during the code obfuscation process, before the obfuscated code is executed. This preliminary action creates a lookup table that enables subsequent stack traces to be deobfuscated on-demand without affecting the security of the running obfuscated code.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If obfuscation is applied to protect software, then reverse engineering is impeded, but debugging capability is reduced

Engineering Contradiction:
Improvereverse engineering protectionVSAvoiddebugging capability
Core Design Contradiction:
ReliabilityVSEase of repair

Solution Approach 1:

The obfuscation log serves as a mediator that enables debugging tools to retrieve original code element names for stack traces during debugging sessions, while the obfuscated code continues to run protected. This allows developers to debug using meaningful original names without exposing the obfuscated code structure to potential reverse engineers.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent applies deobfuscation selectively only to stack trace information where it is needed for debugging, while leaving the actual obfuscated code unchanged. This local application of quality transformation maintains security in the code while improving readability only in the diagnostic output.

Inventive Principle:
Principle #3Local quality

3Ease of operation

If stack traces include original code names for debugging, then error identification is improved, but code security is compromised

Engineering Contradiction:
Improveerror identificationVSAvoidcode security
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The obfuscation log acts as a secure intermediary that enables stack traces to display original code names for better error identification, while the actual obfuscated code remains protected. The log provides the necessary mapping information without exposing the obfuscated code structure or enabling easy reverse engineering.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent creates a copy of the code element name mapping information in the obfuscation log, which is then used to generate deobfuscated stack traces. This copying approach allows the original meaningful names to appear in stack traces without exposing or copying the actual obfuscated code structure that would compromise security.

Inventive Principle:
Principle #26Copying

Data Source

PatentUS9830478B1Logging from obfuscated code
Publication Date: 2017.11.28 MICROSOFT TECHNOLOGY LICENSING LLC
  • US9830478B1 patent drawing
  • US9830478B1 patent drawing
  • US9830478B1 patent drawing

AI summary

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for receiving an encrypted version of an obfuscated stack trace representing an error generated by error handling code of obfuscated code executed by a user device, the obfuscated stack trace having obfuscated code element names corresponding to deobfuscated code element names in a deobfuscated version of the code; decrypting the encrypted stack trace to generate an obfuscated stack trace; receiving an encrypted obfuscation log that maps obfuscated code element names of the obfuscated code executed by the user device to deobfuscated code element names in the deobfuscated version of the code; decrypting the encrypted obfuscation log to generate a decrypted obfuscation log; and generating a deobfuscated stack trace using the decrypted obfuscation log, the deobfuscated stack trace having deobfuscated code element names.