Lightweight Dispatcher for Control Flow Flattening
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for obscuring control flow in computer programs are inadequate in preventing reverse engineering and static analysis, as they often require secret keys and introduce significant runtime overhead, and do not effectively obscure the execution flow through code blocks.
Innovation Solution
A method that initializes a state variable and a switching variable, selects a code block for execution, updates the state variable using a block-dependent constant, and applies a non-injective output function to the switching variable, making it difficult to predict the next code block to be executed, while minimizing execution time overhead and avoiding the need for secret keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control flow obfuscation techniques are applied to hinder reverse engineering, then security against static attacks is improved, but execution time overhead increases
Solution Approach 1:
The code is divided into multiple basic blocks that are randomly permuted and interspersed with fake/dead code segments. The dispatcher function segments the control flow management by maintaining a state variable that tracks the current position in the original code sequence, allowing the obfuscated code to execute efficiently while maintaining security.
Solution Approach 2:
The state variable and switching variable mechanisms change the control flow parameters dynamically during execution. By using a state variable to track progress and a switching variable to select between real and fake code blocks, the system achieves both security and efficiency without excessive overhead.
2Reliability
If control flow flattening is used to obscure execution flow, then resistance to reverse engineering is improved, but device complexity increases
Solution Approach 1:
The control flow management logic is extracted into a separate dispatcher function that handles the complexity of state tracking and block selection. This separates the obfuscation mechanism from the main code blocks, making the overall system more manageable despite the increased complexity in the dispatcher.
Solution Approach 2:
The dispatcher function serves multiple purposes: it tracks execution state, selects the next code block to execute, manages random permutation of blocks, and coordinates with the state variable. This multi-functionality consolidates complexity into a single component rather than distributing it throughout the code.
3Reliability
If secret keys are used in obfuscation methods, then protection against static attacks is improved, but ease of operation deteriorates due to key management requirements
Solution Approach 1:
The obfuscation system is self-service in that it does not require external secret keys for operation. The state variable and switching variable mechanisms provide inherent protection against static analysis without requiring key management, making the system easier to operate while maintaining security.
Data Source
AI summary
A method to obscure a control execution flow in a computer program includes initializing a state variable, q, and a switching variable, selecting a code block for execution using a present value of the switching variable, executing the code block, updating the state variable based on a present value of the state variable and a block-dependent constant that is associated with the code block to generate an updated state variable, and by applying a state update function to the updated state variable, and updating the switching variable by processing the state variable through a non-injective output function that generates a new value of the switching variable based on the state variable. The operations of selecting the code block, executing the code block, updating the state variable and updating the switching variable are repeated to control execution flow.