Obfuscating Computer Program Code via Algebraic Entry Point Encoding

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for tamper protection of computer program code, such as encryption and obfuscation, are inadequate in preventing the construction of call graphs, which are crucial for reverse engineering, as they can be decrypted or analyzed by skilled attackers, and require additional hardware for effective protection.

Innovation Solution

A computer-implemented method that processes the program to replace function calls with modified calls containing algebraic expressions for computing entry points, using encoding and decoding functions to obscure the relation between call sites and function entry points, making it difficult for attackers to construct the call graph through static analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Object-affected harmful factors

If encryption techniques are used to protect computer program code, then the code becomes harder to analyze by attackers, but skilled attackers can still decrypt the code using embedded keys and algorithms

Engineering Contradiction:

Improvereverse engineering difficultyVSAvoidprotection effectiveness

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The patent extracts the decryption logic from the protected code and places it in a separate obfuscation module. This separation prevents attackers from easily obtaining both the encrypted code and its decryption keys/algorithms together, as the decryption mechanism is isolated and itself obfuscated.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces an intermediary obfuscation layer between the encrypted code and the decryption process. This intermediary transforms the decryption logic into obfuscated control flow graphs, making it difficult for attackers to understand the decryption mechanism even if they access it.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If hardware-based decryption techniques are used, then protection against reverse engineering is improved, but additional specific hardware is required

Engineering Contradiction:

Improvereverse engineering difficultyVSAvoidhardware requirements

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent replaces hardware-based decryption mechanisms with software-based obfuscation techniques. Instead of requiring specialized hardware modules for decryption, the system uses software obfuscation to protect the decryption logic, thereby eliminating the need for additional hardware while maintaining protection effectiveness.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent creates a universal obfuscation framework that can protect various types of code and decryption mechanisms without requiring hardware-specific implementations. The obfuscation module works across different platforms and hardware configurations, providing hardware-independent protection.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Difficulty of detecting and measuring

If the call graph is made opaque through obfuscation, then static analysis becomes more difficult, but the code must remain executable

Engineering Contradiction:

Improvecall graph construction difficultyVSAvoidcode executability

Core Design Contradiction:

Difficulty of detecting and measuringVSEase of operation

Solution Approach 1:

The patent transforms static call graph information into dynamic control flow that is resolved at runtime. The obfuscated code uses dynamic control flow graphs where the actual control flow is determined during execution rather than being statically determinable, making static analysis ineffective while preserving executability.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent moves the call graph information from the static dimensional space (where it would be visible in traditional code structure) to a dynamic dimensional space (resolved at runtime through obfuscated control flow). This dimensional transformation makes the call graph invisible to static analysis tools while maintaining functional correctness.

Inventive Principle:

Principle #17Another dimension (Dimensionality change)

Data Source

PatentUS8286251B2Obfuscating computer program code

Publication Date: 2012.10.09 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

AI summary

A computer-implemented method of tamper-protecting a computer program, the method comprising: processing an input representation of the computer program to identify a function call for causing a data processing system to continue execution of the computer program at a predetermined entry point memory address when said computer program is executed by a data processing system; replacing the identified function call with a modified function call, wherein the modified function call includes an algebraic expression for causing the data processing system to compute the entry point memory address when said computer program is executed by the data processing system.