System and method for obfuscating code using instruction replacement scheme
AssigneeMicrosoft Corporation
InventorsPavel Zeman, Michael D. Marr
Life of this patent
Estimating the term…
Abstract
A technique for obfuscating code. A list of one-byte instructions for a particular processor is created. Bytes in a function to be obfuscated are randomly selected, and these bytes are replaced with one-byte instructions from the list. A table that identifies the replaced bytes and their original values is inserted into the executable that contains the function. When the function is called, the function is deobfuscated by consulting the table to restore the replaced bytes to their original values.
Claims25
A method of obfuscating a unit of code that executes on a processor, the method comprising:
- selecting a plurality of bytes in said unit of code;
- replacing each of the bytes with a value selected from a list of instructions from the instruction set of the processor to create an obfuscated code unit;
- creating a table indicative of the bytes prior to said replacing step;
- and
- storing in an executable file at least:
- said obfuscated code unit;
- and
- said table.
A computer-readable medium encoded with instructions that are executable on a processor, the instructions being adapted to perform acts comprising:
- consulting a healing table to identify:
- (a) a plurality of bytes to be restored to their original values in a unit of obfuscated executable code, and (b) the original values to which said bytes are to be restored;
- and
- restoring said plurality of bytes to the values identified in said healing table to create a unit of deobfuscated code which is executable on the processor.
A computer-readable medium having encoded thereon data comprising:
- an obfuscated function;
- a healing table which comprises:
- a list of bytes in said obfuscated function;
- the values to which the bytes in said list are to be changed in order to turn said obfuscated function into a non-obfuscated function;
- and
- deobfuscation code which accesses said healing table and which changes the bytes listed in the healing table to their listed values.
A system for creating obfuscated code comprising:
- a list of instructions;
- an obfuscator which randomly selects bytes in said machine code and which creates obfuscated code by replacing the selected bytes with bytes that are on said list;
- a table creator which creates a table indicative of bytes within the machine code that have been replaced and their pre-replacement values;
- a packager which creates an executable file comprising said obfuscated code and said table.
Dependencies are inferred from the claim text.