Multiple instruction dispatch tables for application program obfuscation

A method for application program obfuscation, the method comprising:

• reading an application program comprising code;
• determining a plurality of dispatch tables associated with said application program;
• transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and selecting the dispatch table associated with the result of said modulo-n arithmetic operation;
• and
• sending said application program code.

A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for executing an obfuscated application program, the method comprising:

• receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;
• receiving an application program instruction corresponding to a current instruction counter value;
• selecting an instruction dispatch table based at least on said current instruction counter value, wherein said selecting comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation;
• and
• executing said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.

A program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method for application program obfuscation, the method comprising:

• reading an application program comprising code;
• determining a plurality of dispatch tables associated with said application program;
• transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and selecting the dispatch table associated with the result of said modulo-n arithmetic operation;
• and
• sending said application program code.

An apparatus for executing an obfuscated application program, the apparatus comprising:

• means for receiving an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;
• means for receiving an application program instruction corresponding to a current instruction counter value;
• means for selecting an instruction dispatch table based at least on said current instruction counter value, wherein said means for selecting comprises means for performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and means for selecting the instruction dispatch table associated with the result of said modulo-n arithmetic operation;
• and
• means for executing said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.

An apparatus for application program obfuscation, the apparatus comprising:

• a processor;
• and
• a memory, coupled to said processor, having stored therein computer readable instructions wherein executing said computer readable instructions on said processor provides:
• means for reading an application program comprising code;
• means for determining a plurality of dispatch tables associated with said application program;
• means for transforming said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises means for performing modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and means for selecting the dispatch table associated with the result of said modulo-n arithmetic operation;
• and
• means for sending said application program code.

An apparatus for executing an obfuscated application program, the apparatus comprising a user device configured to:

• receive an obfuscated application program, said obfuscated application program comprising at least one instruction opcode value encoded using one of a plurality of instruction set opcode value encoding schemes;
• receive an application program instruction corresponding to a current instruction counter value;
• select an instruction dispatch table based at least on said current instruction counter value, wherein to select said instruction dispatch table based at least on said current instruction counter value comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and select the instruction dispatch table associated with the result of said modulo-n arithmetic operation;
• and
• execute said application program instruction using said selected instruction dispatch table to obtain a reference to an instruction implementation method corresponding to an opcode value of said application program instruction.

An apparatus for application program obfuscation, the apparatus comprising an application program provider including a processor, and memory, coupled to said processor, having stored therein computer readable instructions wherein upon executing said computer readable instructions on said processor said application program provider is configured to:

• read an application program comprising code;
• determine a plurality of dispatch tables associated with said application program;
• transform said application program into application program code configured to utilize said plurality of dispatch tables during application program execution to determine the location of instruction implementation methods to be executed based at least on use of a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and select the dispatch table associated with the result of said modulo-n arithmetic operation;
• and
• send said application program code.

A data processing system comprising:

• a processor;
• and
• memory, coupled to said processor, for storing data for access by an application program being executed on said data processing system, said memory comprising:
• a data structure stored in said memory, said data structure including information used by said application program to execute an obfuscated application program on said data processing system, said data structure comprising application program code configured to utilize a plurality of dispatch tables during execution of said obfuscated application program to determine a location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and select the dispatch table associated with the result of said modulo-n arithmetic operation.

A data processing system comprising:

• a processor;
• and
• memory, coupled to said processor, for storing data for access by an application program being executed on said data processing system, said memory comprising:
• a data structure stored in said memory, said data structure including information used by said application program to execute an obfuscated application program, said data structure comprising a plurality of dispatch tables used during execution of said obfuscated application program to determine a location of instruction implementation methods to be executed based at least on using a current instruction counter value to select a dispatch table in said plurality of dispatch tables for use with an application program instruction corresponding to said current instruction counter value, wherein to select said dispatch table in said plurality of dispatch tables comprises perform modulo-n arithmetic operation on said current instruction counter value, where n is the number of dispatch tables, each of said dispatch tables associated with a unique number between 0 and n−1, and select the dispatch table associated with the result of said modulo-n arithmetic operation.