Back to results
US 7,584,364 B2Granted
Overlapped code obfuscation
AssigneeMicrosoft Corporation
InventorsMariusz H. Jakubowski, Matthias Jacob
Life of this patent
Estimating the term…
Abstract
A method of code obfuscation includes receiving a code segment. The existing code of the code segment is modified and/or additional code injected to create overlapped code. The overlapped code performs a plurality of semantically different actions depending upon the content of execution. The resulting obfuscated code having overlapped code is then output.
Claims20
A method of code obfuscation, comprising:
- receiving a code segment;
- applying a first obfuscation algorithm to the code segment to generate a first obfuscated code;
- applying a second obfuscation algorithm, different from the first obfuscation algorithm, to the first obfuscated code to generate a second obfuscated code;
- and
- iteratively applying one or more obfuscation algorithms to the second obfuscated code to create overlapped code, in the code segment, for performing a plurality of semantically different actions which depend upon a context of when the overlapped code is executed, the overlapped code resulting from either modifying the second obfuscated code or inserting additional code into the second obfuscated code,
- wherein a particular one of the plurality of semantically different actions performed during execution is a function of one or more conditions of execution selected from a group consisting of a current code path, a program counter, a time, a running thread, a current value of a variable, a program input, data derived from a program input, and a current content of a register.
3 more elements
A method of code obfuscation, comprising:
- receiving a code block;
- applying a first obfuscation algorithm to the received code block to generate a first obfuscated code;
- applying a second obfuscation algorithm, different from the first obfuscation algorithm, to the first obfuscated code to generate a second obfuscated code;
- and
- iteratively applying one or more obfuscation algorithms to the second obfuscated code, wherein at least one of the obfuscation algorithms creates overlapped code in a segment of the code block, the overlapped code performing a plurality of semantically different actions as a function of one or more conditions selected from a group consisting of a current code path, a program counter, time, running thread, a current value of a variable, a program input, data derived from a program input, and a current content of a register.
2 more elements
One or more computer-readable storage media having instructions that, when executed on one or more processors, perform acts comprising:
- receiving a code segment;
- applying a first obfuscation algorithm to the code segment to generate a first obfuscated code;
- applying a second obfuscation algorithm, different from the first obfuscation algorithm, to the first obfuscated code to generate a second obfuscated code;
- and
- transforming the second obfuscated code to perform a plurality of semantically different actions as a function of a context of execution of the second obfuscated code, the transforming comprising either modifying the second obfuscated code or inserting additional code into the second obfuscated code to create overlapped code, and the plurality of semantically different actions being selected from a group consisting of a current code path, a program counter, a time, a running thread, a current value of a variable, a program input, data derived from a program input, and a current content of a register.
2 more elements
Dependencies are inferred from the claim text.