Obfuscation techniques for enhancing software security

A computer program embodied on a computer-readable medium for obfuscating code, comprising:

• logic that identifies one or more source code input files corresponding to source code for the code of an application to be processed;
• logic that selects a required level of obfuscation (the potency);
• logic that selects a maximum execution time or space penalty (the cost);
• logic that reads and parses the input files;
• logic that provides information identifying data types, data structures, and control structures used by the application to be processed;
• logic that selects and applies obfuscating transformations to source code objects until the required potency has been achieved or the maximum cost has been exceeded;
• and
• logic that outputs the transformed code of the application, wherein the transformed code provides weak equivalence to the untransformed code.

An apparatus for obfuscating code, comprising:

• means for identifying one or more source code input files corresponding to source code for the code of an application to be processed;
• means for selecting a required level of obfuscation (the potency);
• means for selecting a maximum execution time or space penalty (the cost);
• means for reading and parsing the input files;
• means for providing information identifying data types, data structures, and control structures used by the application to be processed;
• means for selecting and applying obfuscating transformations to source code objects until the required potency has been achieved or the maximum cost has been exceeded;
• and
• means for outputting the transformed code of the application, wherein the transformed code provides weak equivalence to the untransformed code.

A computer-implemented method for obfuscating computer code, the method including:

• loading the computer code that is to be obfuscated into a memory unit;
• selecting one or more obfuscation transformations to apply to the computer code, wherein at least one obfuscation transformation is one of:
• a transformation that includes converting at least one reducible control flow graph to a non-reducible control flow graph;
• a transformation that includes splitting at least one loop;
• a transformation that includes identifying a programming idiom that is used in the computer code, and replacing at least one programming construct that exemplifies the programming idiom with an equivalent programming construct that does not exemplify the programming idiom;
• a transformation that includes promoting at least one variable to a more general type;
• a transformation that includes merging two variables into a single variable;
• a transformation that includes splitting a variable into at least two variables;
• and
• a transformation that includes replacing at least one string with a call to a procedure that produces the string;
• and
• generating obfuscated computer code by applying the one or more obfuscation transformations to the computer code, wherein the obfuscated computer code is more resistant to reverse engineering, decompilation, or attack than the computer code.

A computer-implemented method for obfuscating computer code, the method including:

• loading the computer code that is to be obfuscated into a memory module;
• performing a preprocessing pass on the computer code, the preprocessing pass serving to gather information about the computer code for use in selecting and applying one or more obfuscation transformations to the computer code;
• selecting one or more obfuscation transformations to apply to the computer code;
• generating obfuscated computer code by applying the one or more obfuscation transformations to the computer code;
• evaluating the obfuscated computer code to obtain an obfuscation level associated with the computer code;
• and
• applying additional obfuscation transformations to the obfuscated computer code if the obfuscation level is less than a predefined amount;
• wherein the obfuscated computer code is rendered more resistant to reverse engineering, decompilation, or attack than the computer code.

A computer program product for obfuscating a computer program or a computer program module, the computer program product including:

• computer code for gathering information about the computer program or module by performing a preprocessing pass on the computer program or module;
• computer code for performing a plurality of obfuscation transformations;
• computer code for selecting an obfuscation transformation to apply to the computer program or module, wherein the selecting is based, at least in part, on the information gathered about the computer program or module during the preprocessing pass;
• computer code for applying one or more obfuscation transformations to the computer program or module;
• computer code for calculating a metric indicative of the degree to which the computer program or module is obfuscated;
• computer code for comparing the metric to a threshold;
• computer code for applying additional obfuscation transformations to the computer program or module if the metric is less than the threshold;
• and
• a computer readable medium that stores the computer codes.

A computer-implemented method for obfuscating computer code, the method including:

• loading the computer code that is to be obfuscated into a memory module;
• performing a preprocessing pass on the computer code, wherein the preprocessing pass serves to gather information about the computer code, and wherein performing the preprocessing pass includes performing at least one of (a) data flow analysis, or (b) data dependence analysis on the computer code;
• selecting one or more obfuscation transformations to apply to the computer code, the one or more obfuscation transformations being selected, at least in part, using the information gathered in the preprocessing pass;
• and
• generating obfuscated computer code by applying the one or more obfuscation transformations to the computer code.

A computer-implemented method for obfuscating computer code, the method including:

• loading the computer code that is to be obfuscated into a memory module;
• selecting one or more obfuscation transformations to apply to the computer code;
• generating obfuscated computer code by applying the one or more obfuscation transformations to the computer code;
• evaluating the obfuscated computer code to obtain an obfuscation level associated therewith;
• and
• applying additional obfuscation transformations to the obfuscated computer code if the obfuscation level is less than a predefined level, wherein the obfuscated computer code is more resistant to reverse engineering, decompilation, or attack than the computer code.

A method of obfuscating a computer program or module, the computer program or module including a first procedure containing a first local variable of a first type and a second procedure containing a second local variable of a second type, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• creating a global variable;
• replacing at least one reference to the first local variable with a reference to the global variable;
• and
• replacing at least one reference to the second local variable with a reference to the global variable.

A method of obfuscating a computer program or module, the computer program or module including at least one reference to a first instance of an indexed data type, the first instance of the indexed data type including at least two elements, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• generating a second instance of the indexed data type and a third instance of the indexed data type;
• storing at least a first element from the first instance of the indexed data type in the second instance of the indexed data type;
• storing at least a second element from the first instance of the indexed data type in the third instance of the indexed data type, the second element being different from the first element;
• replacing a first reference to the first instance of the indexed data type with a reference to the second instance of the indexed data type;
• and
• replacing a second reference to the first instance of the indexed data type with a reference to the third instance of the indexed data type;
• wherein the reference to the second instance of the indexed data type and the reference to the third instance of the indexed data type are designed to retrieve the first element and the second element, respectively.

A method of obfuscating a computer program or module, the computer program or module including at least one reference to a first instance of an indexed data type and at least one reference to a second instance of the indexed data type, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• generating a third instance of the indexed data type;
• storing data from the first instance of the indexed data type and data from the second instance of the indexed data type in the third instance of the indexed data type;
• replacing a reference to the first instance of the indexed data type with a reference to the third instance of the indexed data type;
• and
• replacing a reference to the second instance of the indexed data type with a reference to the third instance of the indexed data type.

A method of obfuscating a computer program or module, the computer program or module including a first instance of an indexed data type, the first instance having n dimensions, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• generating a second instance of the indexed data type, the second instance having m dimensions, m being different from n;
• storing data from the first instance of the indexed data type into the second instance of the indexed data type;
• and
• replacing a reference to the first instance of the indexed data type with a reference to the second instance of the indexed data type, the reference to the second instance of the indexed data type being designed to retrieve a data element from the second instance of the indexed data type that corresponds to a data element in the first instance of the indexed data type to which the reference to the first instance of the indexed data type refers.

A method of obfuscating a computer program or module, the computer program or module being designed to carry out one or more specified tasks, the computer program or module containing at least one variable used in at least one process, the variable being set to an initial value, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation without materially affecting accomplishment of the one or more specified tasks, the alteration including:
• altering the initial value of the variable to yield an altered initial value;
• and
• altering the process to take into account the altered initial value.

A method of obfuscating a computer program or module, the computer program or module containing a variable of a first type, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• creating a variable of a second type, the second type being more general than the first type;
• and
• replacing at least one reference in the computer program or module to the variable of the first type with a reference to the variable of the second type.

A method of obfuscating a computer program or module, the computer program or module including a first character string, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• generating a programming construct designed to dynamically produce the first character string;
• and
• replacing at least one instance of the first character string with the programming construct or a call to the programming construct.

A method of obfuscating a computer program or module, the computer program or module including a first variable and a second variable, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• specifying a third variable;
• replacing a reference to the first variable with a programming construct, the programming construct including at least one programming statement designed to use a value of the third variable to determine a value of the first variable;
• replacing a reference to the second variable with the programming construct, the programming construct including at least one programming statement designed to use the value of the third variable to determine a value of the second variable.

A method of obfuscating a computer program or module, the computer program or module including a first variable, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• specifying an instance of an indexed data type, the instance containing at least two elements;
• and
• replacing at least one reference to the first variable with a first programming construct, the first programming construct including one or more programming statements which use, at least in part, one or more values stored in at least one of the elements of the instance of the indexed data type.

A method of obfuscating a computer program or module, the computer program or module including a first variable value used in a first indexing operation on an instance of an indexed data type, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• creating a first opaque encoding function, the first opaque encoding function using the first variable value to compute a second variable value for use in indexing the instance of the indexed data type;
• and
• replacing the first indexing operation with a second indexing operation, the second indexing operation using the second variable value to index the instance of the indexed data type.

A method of obfuscating a computer program or module, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• incorporating an opaque computational function into the computer program or module, wherein evaluation of the opaque computational function depends, at least in part, on a value of a predefined variable;
• including a first parallel process and a second parallel process in the computer program or module, the first parallel process and the second parallel process determining, at least in part, the value of the predefined variable;
• and
• modifying the computer program or module so that at least one operation depends upon the opaque computational function evaluating to a predefined value.

A method of obfuscating a computer program or module, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• incorporating an opaque computational function into the computer program or module, including:
• generating a first data structure containing first data structure elements, each first data structure element including a first field capable of pointing to at least one other first data structure element;
• generating a first pointer pointing to a particular first data structure element;
• and
• calculating a value of the opaque computational function by using, at least in part, a value of the first pointer;
• altering the computer program or module so that at least one operation depend s upon the opaque computational f unction evaluating to a predefined value.

A method of obfuscating a computer program or module, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• incorporating a first opaque computational function into the computer program or module;
• and
• including a first programming construct in the computer program or module, the first programming construct operable to execute a first group of one or more programming statements if the opaque computational function computes to a first value, and to execute a second group of one or more programming statements if the opaque computational function computes to a second value.

A process for obfuscating a computer program or module, the computer program or module including at least one call to a method in a first library class, the process including:

• creating a second library class, the second library class containing a second set of one or more methods designed to perform one or more of the same operations as a first set of one or more methods contained in the first library class, wherein the second library class is designed to obscure, at least in part, similarity to the first library class;
• and
• replacing in the computer program or module at least one call to a method in the first library class with a call to a method in the second library class;
• whereby the computer program or module is rendered least somewhat more resistant to reverse engineering or decompilation.

A method of obfuscating a computer program or module, the computer program or module including a call to a particular procedure, the particular procedure being one of a group of procedures, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• replacing a call to the particular procedure with the group of procedures itself, each procedure in the group of procedures being located at a different address;
• and
• incorporating a programming construct designed to jump to the address of the particular procedure.

A method of obfuscating a computer program or module, the computer program or module including a first procedure and a second procedure, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• generating a third procedure, the third procedure including:
• at least a portion of the first procedure;
• at least a portion of the second procedure;
• a parameter list for the first procedure;
• a parameter list for the second procedure;
• and
• a programming construct designed to allow a call to the third procedure to specify execution of the first procedure or the second procedure;
• replacing at least one call to the first procedure with a call to the third procedure, the call to the third procedure including information used by the programming construct to cause the third procedure to execute at least a portion of the first procedure.

A method of obfuscating a computer program or module, the computer program or module including a loop, the loop including a body containing at least a first programming statement and a second programming statement, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• unrolling tho loop to form an unrolled loop, the unrolling including replicating the body of the loop one or more times;
• splitting the unrolled loop into at least a first programming sequence and a second programming sequence,
• the first programming sequence including the first programming statement;
• and
• the second programming sequence including the second programming statement;
• whereby the first programming statement and the second programming statement are performed an equivalent number of times as in the unrolled loop.

A method of obfuscating a computer program or computer program module, the computer program or module including at least a first class, the method including:

• performing an alteration on at least a portion of the computer program or module, the alteration being designed to render the computer program or module at least somewhat more resistant to reverse engineering or decompilation, the alteration including:
• generating a second class and a third class, the third class inheriting directly from the second class, and the second class and the third class being designed to replace the first class;
• incorporating the second class and the third class into the computer program or module;
• and
• removing the first class from the computer program or module.

A method of deobfuscating an obfuscated computer program or computer program module, the method including:

• loading the obfuscated computer program or module into a memory unit;
• identifying one or more opaque programming constructs included in the obfuscated computer program or module, wherein identifying the one or more opaque programming constructs includes at least one of:
• (a) performing pattern matching on the obfuscated computer program or module, wherein the pattern matching includes comparing one or more known opaque programming constructs to one or more programming constructs contained in the obfuscated computer program or module;
• (b) performing program slicing on the obfuscated computer program or module;
• and/or
• (c) performing statistical analysis on the computer program or module, wherein the statistical analysis includes (i) analyzing runtime characteristics of one or more predicates contained in the computer program or module, and (ii) determining that at least one predicate evaluates to a given value at least a predefined percentage of the time the computer program or module is run;
• evaluating the one or more opaque programming constructs;
• and
• producing a deobfuscated computer program or module by replacing at least one of the one or more opaque programming constructs with equivalent, non-opaque programming constructs;
• whereby the deobfuscated computer program or module is rendered easier to understand, reverse engineer, or decompile than the obfuscated computer program or module.

A method of deobfuscating an obfuscated computer program or computer program module, the method including:

• loading the obfuscated computer program or module into a memory unit;
• determining that an obfuscation transformation has been applied to the obfuscated computer program or module;
• selecting one or more deobfuscation transformations to apply to the obfuscated computer program or module, the one or more deobfuscation transformations being operable to counteract at least some effects of the obfuscation transformation;
• and
• applying the one or more deobfuscation transformations to the obfuscated computer program or module, whereby the obfuscated computer program or module is rendered more amenable to reverse engineering, decompilation, or attack.