Monitoring Program for Software Protection Against Debugger Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting programs from analysis and tampering, such as software tamper-resistant techniques and obfuscation, are inadequate in preventing monitoring by debuggers, which can lead to theft of secret information.
Innovation Solution
Implementing a monitoring program that only monitors the protection target program, allowing it to check if the monitoring program is started and preventing other programs from monitoring, thereby ensuring the protection target program's integrity and secrecy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If software tamper-resistant techniques and obfuscation are used to protect programs, then program analysis difficulty is improved, but debugger monitoring capability cannot be prevented
Solution Approach 1:
The patent applies preliminary action by embedding a monitoring program that starts before the protected program executes and establishes monitoring capabilities in advance. The monitoring program is launched first, sets up its monitoring infrastructure, and then the protected program is started under its supervision. This ensures that when the protected program runs, the monitoring program is already in position to detect debugger activity, preventing the reliability gap left by post-hoc protection methods.
Solution Approach 2:
The patent uses an intermediary approach by introducing a monitoring program as a mediator between the debugger and the protected program. The monitoring program intercepts communications and monitoring attempts between debuggers and the protected program, acting as a barrier that can detect and respond to debugger activity. This intermediary layer provides the missing protection against debugger monitoring while maintaining the benefits of tamper-resistant techniques.
2Loss of information
If program encryption and relocation processing are implemented, then data security is improved, but program execution complexity increases
Solution Approach 1:
The patent applies the taking out principle by extracting the decryption and execution logic from the protected program itself and placing it in the monitoring program. The protected program is stored in encrypted form, and the monitoring program is responsible for decrypting and executing it. This separation reduces the complexity burden on the protected program while maintaining data security, as the complex decryption and monitoring functions are handled by a dedicated external program.
3Difficulty of detecting and measuring
If function pointers and obfuscation techniques are used, then control structure analysis is improved, but system resource consumption increases
Solution Approach 1:
The patent applies partial action by implementing obfuscation and monitoring only for critical sections of the program rather than the entire program. The monitoring program focuses on detecting debugger activity and protecting sensitive operations, while allowing non-critical portions to execute with minimal overhead. This selective approach maintains control structure protection while reducing the overall resource consumption compared to comprehensive obfuscation of the entire program.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
An information processing system includes a monitoring program starting unit and a protection target program monitoring unit. When a protection target program to be protected is started, the monitoring program starting unit starts a monitoring program that monitors the protection target program. The protection target program monitoring unit monitors the protection target program by the monitoring program.