Software Dynamic Translation Anti-Tampering Virtual Machine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection methods face challenges in effectively preventing tampering and reverse engineering, as they often result in high overhead, require specialized hardware, or provide incomplete solutions that are not suitable for modern hardware threats.
Innovation Solution
The use of software dynamic translation and virtual machine technology to apply continuous anti-tampering and obfuscation transforms, encrypting code, and periodically flushing the code cache to prevent information leakage, while allowing for low overhead execution and adjustable protection levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If code obfuscation is applied to protect software from static analysis, then it becomes more difficult for hackers to understand the code, but it provides no protection against dynamic analysis through multiple program runs
Solution Approach 1:
The patent applies dynamic code transformation techniques where the code structure and behavior change during execution. Virtual machine instructions are transformed at runtime, making the code different in each execution cycle. This dynamic approach prevents attackers from gathering complete information through multiple runs, as the code appears different each time it executes, thereby providing protection against both static and dynamic analysis while maintaining execution efficiency.
2Reliability
If strong anti-tampering measures are implemented, then software protection is improved, but execution overhead becomes extremely high and unacceptable
Solution Approach 1:
The patent implements selective code transformation where only critical code sections requiring protection are transformed through the virtual machine layer. Non-critical code paths execute natively without transformation overhead. This partial application of anti-tampering measures to only the necessary portions of code provides adequate protection while minimizing execution overhead and maintaining acceptable performance for the overall application.
3Reliability
If self-checking codes are added to monitor code modifications, then tampering detection is improved, but the code becomes more complex and easier to locate by malicious users
Solution Approach 1:
The patent introduces a virtual machine as an intermediary layer between the original code and the execution environment. The virtual machine instructions include embedded self-checking mechanisms that verify code integrity during execution. This intermediary approach allows tampering detection to be implemented without directly modifying the original code structure, thereby maintaining code simplicity while providing robust tampering detection capabilities through the virtual machine layer.
Data Source
AI summary
Method, system and computer program product for applying existing anti-tampering and obfuscation techniques to virtual machine technology and offers several distinct advantages. The anti-tampering and obfuscation transforms can be applied continuously to prevent adversaries from gaining information about the program through emulation or dynamic analysis. In addition, the encryption can be used to prevent hackers from gaining information using static attacks. The use of a virtual machine also allows for low overhead execution of the obfuscated binaries as well as finer adjustment of the amount of overhead that can be tolerated. In addition, more protection can be applied to specific portions of the application that can tolerate slowdown. The in-corporation of a virtual machine also makes it easy to extend the technology to integrate new developments and resistance mechanisms, leading to less development time, increased savings, and quicker deployment.