Software self-defense systems and methods

Abstract

Systems and methods are disclosed for protecting a computer program from unauthorized analysis and modification. Obfuscation transformations can be applied to the computer program's local structure, control graph, and/or data structure to render the program more difficult to understand and/or modify. Tamper-resistance mechanisms can be incorporated into the computer program to detect attempts to tamper with the program's operation. Once an attempt to tamper with the computer program is detected, the computer program reports it to an external agent, ceases normal operation, and/or reverses any modifications made by the attempted tampering. The computer program can also be watermarked to facilitate identification of its owner. The obfuscation, tamper-resistance, and watermarking transformations can be applied to the computer program's source code, object code, or executable image.

1 - 78 . (canceled)  
   
   
       79 . A system for obfuscating computer code, the system comprising: 
 a memory unit, the memory unit including: 
 a binary code modification tool;  
 a program module containing routines for applying predefined obfuscation transformations to computer code; and  
 a computer program operable to associate the binary code modification tool with the program module to yield an obfuscation program;  
   a processor for executing the obfuscation program;    wherein the obfuscation program, when executed, is operable to accept computer code as input, to separate the accepted computer code into instructions and data, and to perform transformations on the instructions to produce an obfuscated computer code, the transformations tending to render the computer code more resistant to reverse engineering, decompilation, or attack.    
   
   
       80 . A system as in  claim 79 , wherein the obfuscation program is further operable to analyze the instructions to determine structure.  
   
   
       81 . A system as in  claim 80 , wherein the obfuscation program is further operable to separate the instructions into basic blocks.  
   
   
       82 . A system as in  claim 81 , wherein the obfuscation program is further operable to identify one or more procedures or functions within one or more basic blocks.  
   
   
       83 . A system as in  claim 79 , wherein the memory unit further includes a compiler for compiling the input computer code.  
   
   
       84 . A system as in  claim 83 , wherein the binary code modification tool is integrated with the compiler.  
   
   
       85 . A system as in  claim 84 , wherein the compiler is controlled by a mode switch, the mode switch allowing the compiler to be switched into or out of a mode in which the binary code modification tool functions to obfuscate code.  
   
   
       86 . A system as in  claim 84 , wherein the compiler applies global software defense techniques at substantially the same time as applying localized software defense techniques.  
   
   
       87 . A system as in  claim 86 , wherein the localized software defense techniques include at least one of techniques for discouraging pattern-matching, techniques for confusing static analysis, techniques for discouraging dynamic analysis, techniques for supplying disinformation, and techniques for applying complex transformations.  
   
   
       88 . A system as in  claim 83 , wherein the compiler generates hints for use by the obfuscation program in obfuscating the computer code.  
   
   
       89 . A system as in  claim 79 , wherein the transformations performed by the obfuscation program on the instructions include at least one of instruction insertion, instruction alteration, and structure alteration.  
   
   
       90 . A system as in  claim 79 , wherein the computer code accepted as input includes one or more of object code and assembly code.  
   
   
       91 . As system as in  claim 79 , wherein the memory unit further includes a source code preprocessor for rearranging at least one of data declarations, and structure or class members.  
   
   
       92 . A system as in  claim 79 , wherein the obfuscation program separates the accepted computer code into instructions and data by, at least in part, performing control flow analysis.  
   
   
       93 . A method for obfuscating a computer program, the method including: 
 linking a binary code modification tool with a program module to form an obfuscation program, wherein the program module contains computer code for performing a plurality of obfuscation transformations;    loading a target program into a memory unit;    separating the target program into instructions and data; and    executing the obfuscation program, the obfuscation program being operable to: 
 accept at least a portion of the instructions of the target program as input;  
 perform one or more obfuscation transformations on the instructions; and  
 write an obfuscated version of the target program using at least part of the transformed instructions to a memory unit as output.  
   
   
   
       94 . A method as in  claim 93 , wherein the obfuscation program is further operable to analyze the instructions to determine structure.  
   
   
       95 . A method as in  claim 94 , wherein the obfuscation program is further operable to separate the instructions into basic blocks.  
   
   
       96 . A method as in  claim 95 , where in the obfuscation program is further operable to identify one or more procedures or functions within one or more basic blocks.  
   
   
       97 . A method as in  claim 93  further including: 
 compiling the target program with a compiler before loading it into the memory unit.    
   
   
       98 . A method as in  claim 97 , wherein the binary code modification tool is integrated with the compiler.  
   
   
       99 . A method as in  claim 98 , further including: 
 controlling the compiler with a mode switch to allow the compiler to be switched into or out of a mode in which the binary code modification tool functions to obfuscate code.    
   
   
       100 . A method as in  claim 98 , wherein the compiler is operable to apply global software defense techniques at substantially the same time as applying localized software defense techniques.  
   
   
       101 . A method as in  claim 100 , wherein the localized software defense techniques applied by the compiler include at least one of techniques for discouraging pattern-matching, techniques for confusing static analysis, techniques for discouraging dynamic analysis, techniques for supplying disinformation, and techniques for applying complex transformations.  
   
   
       102 . A method as in  claim 97 , wherein the compiler is further operable to generate hints for use by the obfuscation program in obfuscating the target program.  
   
   
       103 . A system as in  claim 93 , wherein the one or more obfuscation transformations performed by the obfuscation program includes at least one of instruction insertion, instruction alteration, and structure alteration.  
   
   
       104 . A system as in  claim 93 , wherein the target program includes one or more of object code and assembly code.  
   
   
       105 . A system as in  claim 93 , further including: 
 rearranging at least one of data declarations, and structure or class members using a source code preprocessor.    
   
   
       106 . A method as in  claim 93 , further including: 
 performing control flow analysis to separate the target program into instructions and data.