Dynamic Function Call Obfuscation via Runtime Self-Modification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing control-flow obfuscation methods are inadequate in protecting software against static and dynamic attacks, particularly failing to conceal function call structures and graphs, making them vulnerable to code lifting and tampering.

Innovation Solution

A method that comprehensively transforms a software program's control flow structure by analyzing and modifying function-call layouts and graphs at build time, with dynamic self-modifications at runtime, to create a semantically equivalent but obfuscated program that disguises function boundaries and call sequences, making it difficult for attackers to determine the original function call graph or structure.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If traditional calling conventions are used, then function call boundaries are clear and easy to implement, but function call structures become easy targets for attackers to analyze and lift code

Engineering Contradiction:

Improveease of implementationVSAvoidvulnerability to code lifting attacks

Core Design Contradiction:

Ease of manufactureVSObject-affected harmful factors

Solution Approach 1:

The patent applies dynamics by transforming static function call boundaries into dynamic ones. Functions are wrapped with prologues and epilogues that modify control flow at runtime, making the actual function boundaries unpredictable. The wrapper functions dynamically determine which original function to call based on runtime conditions, preventing attackers from statically analyzing or lifting the original function structures.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent introduces wrapper functions as intermediaries between the attacker and the original function code. These wrappers act as a layer of indirection that obscures the true function boundaries and call structures. The wrappers contain the actual function invocation logic while presenting a different, obfuscated interface to external analysis tools.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If existing control-flow obfuscation methods are applied to local control-flow, then function scope is protected, but call-structure remains vulnerable to discovery and code lifting

Engineering Contradiction:

Improveprotection against static analysisVSAvoidcomplexity of obfuscation scope

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the protection scope from local control-flow to global call-structure by applying obfuscation at multiple levels. Each function is individually wrapped with obfuscating prologues and epilogues, and the overall program structure is transformed through systematic wrapper insertion. This multi-level segmentation allows comprehensive protection while maintaining manageable complexity through modular transformation rules.

Inventive Principle:

Principle #1Segmentation

3Difficulty of detecting and measuring

If self-modifying code techniques are applied to straight-line instruction blocks, then data operations are concealed, but macro control level remains exposed to attackers

Engineering Contradiction:

Improveconcealment of data operationsVSAvoidscope of obfuscation coverage

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The patent merges local data operation obfuscation with global control-flow obfuscation into a unified protection mechanism. The prologues and epilogues combine both data manipulation techniques and control-flow modification, creating a comprehensive obfuscation layer that simultaneously conceals both data operations and macro control structures through integrated transformation rules.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentEP2486482B1A system and method for aggressive self-modification in dynamic function call systems

Publication Date: 2018.02.28 IRDETO BV

Figure 1
Figure 2
Figure 3a

AI summary

Embodiments of the invention provide a system and method for software obfuscation for transforming a program from a first form to more secure form that is resistant to static and dynamic attacks. In an embodiment, the method utilizes a sophisticated pre-analysis step to comprehend the function-call structure, the function-call layout, and the entire function call graph of the program, in order to determine strategic points in the program for changing the program. The method provides resistance to static attacks by transforming the original function-call layout to a new layout. In an embodiment changing the layout may include changing the function boundaries. The method also provides resistance to static attacks by transforming the original function-call structure to a new structure to be able to self modify as the transformed program executes in memory. In an embodiment, changing the function-call structure may include modifying when and how functions are called, and/or choosing random paths of execution that lead to the same result. The transformed program is semantically equivalent to the original program but is more resistant to static and dynamic attacks.