Source Code Extraction from Obfuscated Byte Code via VM Instrumentation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods fail to effectively reverse-engineer obfuscated byte code to retrieve original source code due to strong obfuscation techniques, which complicates security measures like malware analysis and source code protection.

Innovation Solution

Implementing a source code extraction system that uses instrumentation and a virtual machine interpreter to process obfuscated byte code, generating semantic, structural, or decompiled representations of the original source code by monitoring and recording instruction sequences.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If strong obfuscation techniques are applied to protect source code confidentiality, then source code protection is improved, but reverse engineering capability deteriorates

Engineering Contradiction:

Improvesource code protectionVSAvoidreverse engineering capability

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent introduces a virtual machine as an intermediary layer between the obfuscated byte code and the extraction system. The virtual machine executes the obfuscated code and generates intermediate representations that preserve the original source code structure, enabling reverse engineering without directly analyzing the obfuscated code. This mediator approach allows the system to maintain source code protection through obfuscation while still enabling effective reverse engineering through the virtual machine's intermediate output.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If obfuscation techniques like name obfuscation, string encryption, and code flow encryption are applied, then source code confidentiality is improved, but source code extraction capability deteriorates

Engineering Contradiction:

Improvesource code confidentialityVSAvoidsource code extraction capability

Core Design Contradiction:

Loss of informationVSMeasurement precision

Solution Approach 1:

The patent creates copies of the execution state and instruction sequences within the virtual machine environment. Instead of directly analyzing the obfuscated code, the system copies the execution traces and instruction sequences generated by the virtual machine, which contain the semantic meaning without the obfuscation. This copying approach preserves confidentiality while enabling precise extraction of source code representations.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent replaces direct mechanical analysis of obfuscated code with a virtualized execution model. The virtual machine substitutes the direct analysis process, executing the obfuscated code and generating high-level representations automatically. This substitution eliminates the need to directly parse obfuscated structures, maintaining confidentiality while enabling accurate source code extraction through automated virtual execution.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Productivity

If instrumentation is used to monitor virtual machine execution, then source code extraction capability is improved, but system complexity increases

Engineering Contradiction:

Improvesource code extraction capabilityVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent merges the instrumentation functionality directly into the virtual machine's execution engine. Rather than adding separate monitoring tools, the extraction capabilities are integrated into the virtual machine's core execution path. This merging approach improves extraction capability while minimizing additional complexity, as the instrumentation shares the virtual machine's existing infrastructure for code execution and state management.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS11822920B1Methods and systems for providing a source code extractions mechanism

Publication Date: 2023.11.21 STRIPE LLC

AI summary

In embodiments, methods and systems for implementing source code extraction are provided. Source code extraction facilitates processing obfuscated byte code and extracting source code representations of original source code of applications. Source code extraction is implemented based on leveraging and monitoring an interpreter (e.g., a software interpreter running on a virtual machine) when portions of obfuscated byte code (i.e., obfuscated compiled version of source code) are loaded or executed using the interpreter. In operation, the obfuscated byte code is accessed at the interpreter. The interpreter, processing the obfuscated byte code, is monitored using a source code extraction manager that supports instrumentation instances associated with functions of the obfuscated byte code. Instruction sequences of functions that the interpreter is processing are recorded using the source code extraction manager. Source code representations are generated based on the instruction sequences that are recorded while monitoring the functions that are processed by the interpreter.