# US 7,613,907 B2 · Embedded software camouflage against code reverse engineering > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,613,907 B2 - Document ID: US7613907B2 - Status: Granted - Kind: B2 - Application number: 11/558,357 - Filed: 2006-11-09 - Published: 2008-02-14 - Granted: 2009-11-03 - Earliest claimed: 2006-08-11 - Assignees: Atmel Corporation - Inventors: Majid Kaabouch; Eric Le Cocquen - Web page: https://patentgrep.com/patent/US7613907B2 ## CPC - G06F 21/77: in smart cards - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/755: {with measures against power attack} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and apparatus for identifying a first flow control instruction in an executing program, the first instruction being associated with a first program address at which program execution will continue after execution of the first instruction. A determination is made as to whether the first program address is protected. If the first program address is protected, a first alternate program address is substituted for the first program address such that program execution will continue at the first alternate program address after execution of the first instruction. ## Claims ### Claim 1 A method comprising: receiving a program stored in on-chip memory of a system, the program including a flow control instruction, the flow control instruction referencing a program address operand, the system including a first program address register and a corresponding second program address register, the first program register being pre-loaded with a camouflage program address prior to program execution, the second program register being pre-loaded with an alternate program address prior to program execution, and the camouflage program address matching the program address operand referenced by the flow control instruction; during execution of the program, identifying the flow control instruction in the program and the referenced program address operand; determining if the referenced program address operand is protected; and if the referenced program address operand is protected, substituting the alternate program address for the referenced program address operand such that program execution continues at the alternate program address after execution of the flow control instruction. ### Claim 2 (depends on 1) The method of claim 1, where the determining includes: determining if the referenced program address operand matches the camouflage program address. ### Claim 3 (depends on 1) The method of claim 1, where: the first program address register and the second program address register are inaccessible to an execution unit of the system. ### Claim 4 (depends on 1) The method of claim 1, where: the flow control instruction is a call instruction, a branch instruction or a jump instruction. ### Claim 5 (depends on 1) The method of claim 1, further comprising: executing a camouflaged returned instruction. ### Claim 6 (depends on 1) The method of claim 1, where the substituting includes: determining if camouflaging of the referenced program address operand is enabled. ### Claim 7 (depends on 1) The method of claim 1, further comprising: continuing program execution at the alternate program address. ### Claim 8 A system comprising: memory, the memory containing a program, the program including a flow control instruction referencing a program address operand at which program execution will continue after execution of the flow control instruction; a first plurality of program address registers, the first plurality of program address registers being pre-loaded prior to program execution with a plurality of camouflage program addresses, the plurality of camouflage program addresses including a first camouflage program address matching the referenced program address operand; a second plurality of program address registers, the second plurality of program address registers being pre-loaded prior to program execution with a plurality of alternate program addresses, and the plurality of alternate program addresses including a first alternate program address associated with the first camouflage program address; an engine operable to: during execution of the program, identify the flow control instruction in the program and the referenced program address operand; determine if the referenced program address operand is protected; and if the referenced program address operand is protected, substitute the first alternate program address for the referenced program address operand such that program execution continues at the first alternate program address after execution of the flow control instruction. ### Claim 9 (depends on 8) The system of claim 8, where: the referenced program address is protected if the referenced program address operand matches the first camouflage program address. ### Claim 10 (depends on 8) The system of claim 8, where: the first and the second pluralities of program address registers are inaccessible to an execution unit of the system. ### Claim 11 (depends on 8) The system of claim 8, where: the flow control instruction is a call instruction, a branch instruction or a jump instruction. ### Claim 12 (depends on 8) The system of claim 8, where the engine is further operable to: execute a camouflaged returned instruction. ### Claim 13 (depends on 8) The system of claim 8, where the engine is further operable to: determine if camouflaging of the referenced program address operand is enabled. ### Claim 14 (depends on 8) The system of claim 8, where the engine is further operable to: continuing program execution at the first alternate program address. ### Claim 15 A program address camouflage unit comprising: a first memory portion whose contents are preloaded prior to program execution and identify camouflage program addresses; a second memory portion whose contents are preloaded prior to program execution and store alternate program addresses corresponding to the camouflage program addresses; and a replacement unit that, during program execution, a) determines whether a fetched flow control instruction operand matches a camouflage program address identified by the contents of the first memory portion, and if so, b) replaces the fetched flow control instruction operand with an address selected from the second memory portion. ### Claim 16 (depends on 15) The program address camouflage unit of claim 15, where: a flow control instruction is a call instruction, a branch instruction or a jump instruction. ### Claim 17 (depends on 15) The program address camouflage unit of claim 15, where the replacement unit is further capable of: determining whether replacement of the operand is enabled. ### Claim 18 (depends on 15) The program address camouflage unit of claim 15, where the first memory portion and the second memory portion are inaccessible to an execution unit. ### Claim 19 A system comprising: memory containing program instructions, at least one program instruction being a control flow instruction referencing a program address operand at which program execution will continue after execution of the flow control instruction; an instruction fetch unit operable to fetch program instructions; an instruction decode unit operable to decode the fetched program instructions; a first plurality of program address registers, one of the first plurality of program address registers being preloaded with a camouflage program address matching the program address operand referenced by the flow control instruction; a second plurality of program address registers, one of the second plurality of program address registers being preloaded with an alternate program address associated with the camouflage program address; and a replacement unit operable to substitute the referenced program address operand with the alternate program address during program execution such that program execution continues at the alternate program address after execution of the flow control instruction.