Executable File Protection via Real-Time Decryption and Debug Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing binary code obfuscation techniques for executable files and shared libraries face challenges such as increased execution time and performance overhead, higher development and maintenance costs, reversibility, difficulty in processing pointers and data, and incomplete protection against reverse engineering and debugging.
Innovation Solution
A protection method that determines whether a process is being debugged or formed by an encrypted executable file, and prohibits execution or memory mapping of encrypted files to prevent decryption and leakage during debugging, using a security context and labels to enforce anti-reverse engineering and anti-debugging measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code reorganization and instruction replacement are used for binary obfuscation, then reverse engineering difficulty is increased, but execution time and performance overhead increase
Solution Approach 1:
The patent applies preliminary action by detecting debugging attempts before the actual reverse engineering can occur. The system sets up detection mechanisms that monitor for debugger attachment, memory mapping operations, and other suspicious activities before the attacker can extract meaningful information from the obfuscated code, thereby preventing the need to reverse the obfuscation.
2Reliability
If code reorganization and instruction replacement are used for binary obfuscation, then reverse engineering difficulty is increased, but development and maintenance cost increase
Solution Approach 1:
The patent implements self-service by providing automated protection mechanisms that do not require manual intervention during development or maintenance. The system automatically detects debugging attempts, monitors memory operations, and enforces protection policies without requiring developers to manually configure or maintain complex obfuscation rules, thereby reducing development and maintenance costs.
3Reliability
If code reorganization and instruction replacement are used for binary obfuscation, then reverse engineering difficulty is increased, but the protection is reversible
Solution Approach 1:
The patent applies preliminary anti-action by detecting and blocking debugging attempts before the reverse engineering process can begin. The system monitors for debugger attachment, memory mapping operations, and other activities that precede code reversal, and takes preventive action by terminating the process or alerting the user, thereby making the protection effectively irreversible.
4Reliability
If instruction replacement is used for binary obfuscation, then execution logic is more obscure, but processing of pointers and data becomes difficult
Solution Approach 1:
The patent implements an intermediary mechanism by introducing a protection layer that mediates between the obfuscated code and the debugging tools. This intermediary monitors memory operations, tracks pointer usage, and controls data access without requiring direct modification of the obfuscated code structure, thereby maintaining both protection effectiveness and data processing ease.
Data Source
AI summary
A protection method for executable files and shared libraries and a corresponding protection system are provided, which encrypt a part of contents of an executable file or a shared library, decrypt the part of contents in real time when the executable file or the shared library is executed, and prohibit the execution of the encrypted contents of the executable file or the shared library by a debugged process, so as to prevent attackers from obtaining the part of contents of the executable file or the shared library.