Software Control Flow Obfuscation via Extraction and Lookup Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection systems are complex, require access to source code, and incur significant performance impacts, failing to effectively protect against tampering, reverse engineering, and hijacking attacks using buffer overflow and Return-Oriented Programming (ROP) techniques.
Innovation Solution
The solution involves transforming software into a protected execution state by removing control flow instructions and addressing, storing them in a separate file, and using protected execution instructions to restore the original order, while inserting fake code and employing obfuscation techniques like code stirring and decoy paths to create an intractable problem for reverse engineering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing obfuscation and software protection systems are implemented, then software protection against reverse engineering and tampering is improved, but device complexity and processing performance impact increase significantly
Solution Approach 1:
The patent extracts control flow instructions and addressing information from the main software binary and stores them in a separate protected data section. This separation removes the complex protection logic from the execution path, reducing device complexity while maintaining protection. The control flow data is stored externally and referenced during execution, avoiding the need for complex runtime protection systems.
Solution Approach 2:
The patent introduces a lookup table as an intermediary between the main software code and the protected control flow data. This intermediary structure allows the software to access control flow information without direct complex interactions, simplifying the protection mechanism. The lookup table acts as a buffer that manages the interaction between unprotected code and protected control flow data, reducing overall system complexity.
2Reliability
If existing obfuscation and software protection systems are implemented, then software protection against reverse engineering and tampering is improved, but processing performance is significantly degraded
Solution Approach 1:
The patent performs preliminary organization of control flow data into a structured lookup table format during software compilation or preprocessing. This preliminary action ensures that control flow information is readily accessible during runtime without requiring complex real-time processing or protection checks, thereby maintaining processing performance while providing protection.
3Reliability
If source code instrumentation is used for obfuscation, then software protection is achieved, but the approach becomes impractical when source code is unavailable
Solution Approach 1:
The patent extracts control flow information from the compiled binary without requiring access to source code. By focusing on the control flow graph and instruction pointers that exist in the compiled executable, the method makes software protection feasible even when source code is unavailable, significantly improving implementation feasibility.
4Reliability
If control flow instructions are removed and stored separately, then protection against buffer overflow and ROP attacks is improved, but access management becomes more complex
Solution Approach 1:
The patent uses a lookup table as an intermediary to manage access to separated control flow data. This intermediary structure provides a controlled interface between the main execution flow and the protected control flow instructions, simplifying access management while maintaining protection against hijacking attacks. The lookup table manages the complexity of accessing distributed control flow data through a unified, controlled mechanism.
Data Source
AI summary
A method of software article protection and transformation includes: retrieving a software article; identifying control flow addressing associated with the software article; removing at least a portion of the control flow addressing; and saving the at least a portion of the control flow addressing from the software article, wherein removing the at least a portion of the control flow addressing comprises replacing call and return functions with protected execution instructions, wherein the protected execution instructions replace call functions by: identifying, in a lookup table, an entry associated with a current instruction; and pushing a return address associated with the current instruction to a secure return stack; and wherein the protected execution instructions replace return functions by: popping the return address from the secure return stack; encrypting the at least a portion of the control flow addressing; and saving the at least a portion of the control flow addressing to a separate software article that is associated with the software article.