Software Control Flow Obfuscation via Dynamic Branch Targets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for computer software are ineffective in preventing reverse engineering, as they do not adequately impede the disassembly and mapping of control flow between instructions, allowing attackers to understand the inner workings of software programs.
Innovation Solution
The method involves obfuscating the control flow by replacing branch point targets with computed values dependent on prior computed values, and adding non-executed 'fake' code that statistically matches real code, making it difficult to reverse engineer the software flow by using computed values and masked targets in jump tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If branch point targets are replaced with computed values dependent on prior computed values, then the difficulty of reverse engineering increases, but the complexity of the control flow increases
Solution Approach 1:
The patent applies dynamics by replacing static branch target addresses with dynamic computed values that depend on prior executed instructions. This makes the control flow adaptive and context-dependent, increasing the difficulty of reverse engineering while managing complexity through systematic computation rules
Solution Approach 2:
The patent introduces computed values as intermediaries between the original branch targets and the actual control flow. These computed values act as mediators that obscure the direct relationship between branch points and targets, making reverse engineering more difficult while maintaining functional equivalence
2Difficulty of detecting and measuring
If non-executed 'fake' code is added to match statistical properties of real code, then the difficulty of detecting real code increases, but the size of the software increases
Solution Approach 1:
The patent creates copies of code segments with matching statistical properties (opcode frequencies, instruction patterns) to serve as deceptive fake code. These copies mimic the characteristics of real code without executing, making it difficult for reverse engineers to distinguish between real and fake code paths
Solution Approach 2:
The patent changes the parameters of code segments by modifying statistical properties such as opcode distribution and instruction patterns to match between real and fake code. This parameter matching makes the fake code statistically indistinguishable from real code, increasing detection difficulty
3Reliability
If computed values depend on all prior computed values in the program, then the obfuscation effectiveness increases, but the computational overhead increases
Solution Approach 1:
The patent implements feedback mechanisms where each computed branch target value depends on previously computed values in the execution stream. This creates a chain of dependencies that propagates obfuscation effects throughout the program, increasing effectiveness while the systematic feedback structure manages computational overhead
Data Source
AI summary
Methods, media and systems that obfuscate control flow in software programs. The obfuscation can impede or prevent static flow analysis of a software program's control flow. In one embodiment, a method, performed by a data processing system, identifies each branch point in a set of branch points in a first version of software and replaces, in each branch point in the set, a representation of a target of the branch point with a computed value that depends upon at least one prior computed value in a stream of instructions in the first version of software. Other embodiments are also described.