Protection, obfuscation, and optimization of binary executables using recompilation
AssigneeMagic Shell Software, Inc.
InventorAnthony Samuel Jacobs
Life of this patent
Estimating the term…
Abstract
A facility for protecting executables is described. The facility accesses a first executable representation of a program and decompiles it to obtain an intermediate representation of the program. The facility obfuscates the intermediate representation of the program, and recompiles the obfuscated intermediate representation of the program to obtain a second executable representation of the program.
Claims21
A method in a computing system, comprising:
- accessing a first executable representation of a program;
- decompiling the first executable representation of the program to obtain an intermediate representation of the program;
- obfuscating the intermediate representation of the program;
- and
- recompiling the obfuscated intermediate representation of the program to obtain a second executable representation of the program.
One or more instances of computer-readable media collectively storing a data structure, the data structure comprising:
- a second executable version of the program automatically constructed from a first executable version of the program resulting from compiling source code for the program, the second executable version of the program constituting a second sequence of operations that is different from a first sequence of operations that constitute the first executable version of the program, the second sequence of operations of having the same effect on the state established by the first sequence of operations in response to any valid set of input,
- such that the second executable version of the program can be distributed instead of the first executable version of the program.
One or more instances of computer-readable media collectively storing a data structure, the data structure comprising:
- a first intermediate representation of a program obtained by decompile and an executable version of the program comprising a plurality of subroutines;
- and
- a mapping identifying runtime dependencies between pairs of the subroutines of the plurality,
- such that the contents of the data structure are usable to reformulate the first intermediate representation of the program to obtain a second intermediate representation of the program that is different from the first intermediate representation of the program and that produces from any valid combination of starting state and input the same ending state in the same output as the first intermediate representation of the program.
One or more instances of computer-readable media collectively having contents configured to cause a computing system to perform a method, the method comprising:
- accessing a first representation of a program;
- performing an obfuscating alteration to the first representation of the program to obtain a second representation of the program in which a first portion differs from the first representation;
- performing an obfuscating alteration to the second representation of the program to obtain a third representation of the program in which a second portion intersecting the first portion differs from the second representation;
- and
- storing the third representation.
Dependencies are inferred from the claim text.