System, method and computer program product for protecting software via continuous anti-tampering and obfuscation transforms

Abstract

Method, system and computer program product for applying existing anti-tampering and obfuscation technique to virtual machine technology and offers several distinct advantages. The anti-tampering and obfuscation transforms can be applied continuously to prevent adversaries from gaining information about the program through emulation or dynamic analysis. In addition, the encryption can be used to prevent hackers from gaining information using static attacks. The use of a virtual machine also allows for low overhead execution of the obfuscated binaries as well as finer adjustment of the amount of overhead that can be tolerated. In addition, more protection can be applied to specific portions of the application that can tolerate slowdown. The incorporation of a virtual machine also makes it easy to extend the technology to integrate new developments and resistance mechanisms, leading to less development time, increased savings, and quicker deployment.

1 . A computer method of increasing the tamper-resistance and/or obscurity of computer software code, said method comprising:
 preparing the computer software code for execution in a designated execution environment for making it difficult to execute the computer software code independently from the designated execution environment, wherein said preparation comprises applying one or more computer software preparation transformations to the computer software code; and   preparing the execution environment so that it impedes execution of computer software code in the execution environment except for a designated computer software code.   
     
     
         2 . (canceled) 
     
     
         3 . The method of  claim 1 , wherein said computer software preparation transformation comprises encrypting the computer software code using a plurality of keys hidden within the execution environment and/or prepared software code. 
     
     
         4 - 5 . (canceled) 
     
     
         6 . The method of  claim 1 , wherein said computer software preparation transformation further comprises adding additional codes and/or data to the computer software to verify the integrity of at least one of the execution environment and the prepared software code. 
     
     
         7 . (canceled) 
     
     
         8 . The method of  claim 1 , wherein said computer software preparation transformation further comprises altering the computer software code such that proper execution is difficult without undoing the alterations, said altering including at least one of altering: constant operands; program control flow; program data layout; data initialization information; instruction encoding; or file format. 
     
     
         9 - 10 . (canceled) 
     
     
         11 . The method of  claim 1 , wherein said execution preparation comprises applying one or more preparation execution environment transformations to the execution environment computer software code, and wherein said execution environment preparation transformation comprises encrypting some or all of the execution environment, using a plurality of keys hidden within the execution environment and/or prepared software code. 
     
     
         12 - 14 . (canceled) 
     
     
         15 . The method of  claim 1 , wherein said execution environment preparation transformation further comprises adding additional codes and/or data to the computer software execution environment to verify the integrity of at least one of the computer software code and the prepared execution environment. 
     
     
         16 . (canceled) 
     
     
         17 . The method of  claim 1 , wherein said method further comprises applying execution transformations to both of the prepared computer software code and the prepared execution environment during execution of a computer software code to improve tamper resistance and/or obscurity in a designated execution environment, wherein said execution transformation comprises the execution environment changing the layout of computer software code data, the computer software code data being one of at least data used for the execution environment or data to execute the computer software code or data to execute prepared software code. 
     
     
         18 - 19 . (canceled) 
     
     
         20 . The method of  claim 17 , wherein said execution transformation comprises the execution environment using conditions generated during execution, whereby said conditions are difficult to programmatically decipher to assist in the tamper-resistance and/or obscurity transforms. 
     
     
         21 . The method of  claim 17 , wherein the execution transformations include at least one of relocating operational locations to increase the difficulty of determining operation locations for making operation's locations difficult to determine, and rearranging, eliminating or adding execution flow for making execution flow and/or control flow difficult to determine. 
     
     
         22 . (canceled) 
     
     
         23 . The method of  claim 17 , wherein the execution transformations include at least one of inserting additional software code and/or data for making the software code operations difficult to determine, and inserting incorrect codes that are intentionally similar to other correct software codes. 
     
     
         24 . The method of  claim 17 , wherein the execution transformations include at least one of inserting operations that cannot be feasibly executed, but appear as though execution is possible, and randomizing operation order. 
     
     
         25 - 26 . (canceled) 
     
     
         27 . The method of  claim 17 , wherein the execution transformations insert dynamically operations into the execution to verify the integrity of computer software code and/or data, wherein the computer software code and/or data comprises at least one of: prepared computer software code and/or data, unprepared computer software code and/or data, prepared execution environment code and/or data, unprepared execution environment code and/or data, and or previously transformed computer software code and/or data, or any combinations thereof. 
     
     
         28 . (canceled) 
     
     
         29 . The method of  claim 17 , wherein said one or more execution transformations comprises at least one of: control flow flattening, guards, disassembly resistance, self checksumming codes, dynamic disassembly resistance, control flow obfuscations, ABI transforms, API transforms, sequence transforms, calling convention transforms and or data transform, or any combination thereof. 
     
     
         30 . The method of  claim 17 , wherein the execution environment continuously performs the execution transformations, the continuous execution comprising a plurality of encryption/decryption keys. 
     
     
         31 . (canceled) 
     
     
         32 . The method of  claim 17 , wherein said execution environment comprises at least one of: software dynamic translation (SDT), virtual machine (VM), Java VM, Strata VM, program simulators, program emulators, and or virtualization systems, or any combinations thereof. 
     
     
         33 . The method of  claim 17 , wherein said computer software code comprises at least one of: binary, byte code, program source, program assembly, program scripts, machine language, and or program intermediate formats, or any combination thereof and wherein said program scripts comprises at least one of the following:
 Perl, PHP, python, CGI, Java, Java Script, ASP script, MySQL, Borne shell, bash, tcsh, and or csh, or any combinations thereof.   
     
     
         34 - 59 . (canceled) 
     
     
         60 . A computer method of increasing the tamper-resistance and/or obscurity of computer software code, said method comprising:
 applying execution transformations during execution of a computer software code to improve tamper resistance and/or obscurity, wherein said preparation comprises applying one or more computer software preparation transformations to the computer software code; and   preparing the computer software code for execution in a designated execution environment for making it difficult to execute the computer software code independently from the designated execution environment.   
     
     
         61 . The method of  claim 60 , wherein said execution transformation further comprises the execution environment changing the layout of computer software code data, the computer software code data being at least one of data used for the execution environment or data to execute the computer software code or data to execute prepared software code. 
     
     
         62 . (canceled) 
     
     
         63 . The method of  claim 60 , wherein said execution transformation further comprises the execution environment using conditions generated during execution, whereby said conditions are difficult to programatically decipher to assist in the tamper-resistance and/or obscurity transforms. 
     
     
         64 . The method of  claim 60 , wherein the execution transformations include at least one of relocating operational locations to increase the difficulty of determining operation locations for making operation's locations difficult to determine, and rearranging, eliminating or adding execution flow for making execution flow and/or control flow difficult to determine. 
     
     
         65 . (canceled) 
     
     
         66 . The method of  claim 60 , wherein the execution transformations include at least one of inserting additional software code and/or data for making the software code operations difficult to determine, and inserting incorrect codes that are intentionally similar to other correct software codes. 
     
     
         67 . The method of  claim 60 , wherein the execution transformations include at least one of inserting operations that cannot be feasibly executed, but appear as though execution is possible, and randomizing operation order. 
     
     
         68 . (canceled) 
     
     
         69 . (canceled) 
     
     
         70 . The method of  claim 60 , wherein the execution transformations insert dynamically operations into the execution to verify the integrity of computer software code and/or data. 
     
     
         71 . The method of  claim 70 , wherein the computer software code and/or data comprises at least one of: prepared computer software code and/or data, unprepared computer software code and/or data, prepared execution environment code and/or data, unprepared execution environment code and/or data, or previously transformed computer software code and/or data, or any combinations thereof. 
     
     
         72 . The method of  claim 60 , wherein said one or more execution transformations comprises at least one of: control flow flattening, guards, disassembly resistance, self checksumming codes, dynamic disassembly resistance, control flow obfuscations, ABI transforms, API transforms, sequence transforms, calling convention transforms or data transform, or any combination thereof. 
     
     
         73 . The method of  claim 60 , wherein the execution environment continuously performs the execution transformations, the continuous execution comprises a plurality of encryption/decryption keys. 
     
     
         74 . (canceled) 
     
     
         75 . The method of  claim 60 , wherein said execution environment comprises at least one of: software dynamic translation (SDT), virtual machine (VM), Java VM, Strata VM, program simulators, program emulators, or virtualization systems, or any combinations thereof. 
     
     
         76 . The method of  claim 60 , wherein said computer software code comprises at least one of: binary, byte code, program source, program assembly, program scripts, machine language, or program intermediate formats, or any combination thereof, and wherein said program scripts comprises at least one of the following:
 Perl, PHP, python, CGI, Java, Java Script, ASP script, MySQL, Borne shell, bash, tcsh, or csh, or any combinations thereof.   
     
     
         77 - 79 . (canceled) 
     
     
         80 . The method of  claim 60 , wherein said computer software preparation transformation comprises encrypting the computer software code using a plurality of keys hidden within the execution environment and/or prepared software code. 
     
     
         81 . (canceled) 
     
     
         82 . (canceled) 
     
     
         83 . The method of  claim 60 , wherein said computer software preparation transformation comprises at least one of adding additional codes and/or data to the computer software to verify the integrity of at least one of the execution environment, and the prepared software code. 
     
     
         84 . (canceled) 
     
     
         85 . The method of  claim 83 , wherein said computer software preparation transformation comprises altering the computer software code such that proper execution is difficult without undoing the alterations, wherein said altering includes at least one of: altering constant operands, program control flow, program data layout, data initialization information, instruction encoding, or file format, or any combination thereof. 
     
     
         86 . (canceled) 
     
     
         87 . The method of  claim 60 , wherein said execution transformation comprises interpreting said preparation transformations on the prepared software codes. 
     
     
         88 - 125 . (canceled) 
     
     
         126 . A computer program product comprising a computer useable medium having computer program logic for enabling at least one processor in a computer system to increase the tamper-resistance and/or obscurity of computer software code, said computer logic comprising:
 preparing the computer software code for execution in a designated execution environment for making it difficult to execute the computer software code independently from the designated execution environment, wherein said preparation comprises applying one or more computer software preparation transformations to the computer software code; and preparing the execution environment so that it impedes execution of computer software code in the execution environment except for a designated computer software code.   
     
     
         127 . (canceled) 
     
     
         128 . The computer program product of  claim 126 , wherein said computer software preparation transformation comprises encrypting the computer software code using a plurality of keys hidden within the execution environment and/or prepared software code. 
     
     
         129 . (canceled) 
     
     
         130 . (canceled) 
     
     
         131 . The computer program product of  claim 126 , wherein said computer software preparation transformation further comprises adding additional codes and/or data to the computer software to verify the integrity of at least one of the execution environment and the prepared software code. 
     
     
         132 . (canceled) 
     
     
         133 . The computer program product of  claim 131 , wherein said computer software preparation transformation further comprises altering the computer software code such that proper execution is difficult without undoing the alterations, said altering includes at least one of altering constant operands, program control flow, program data layout, data initialization information, instruction encoding, or file format, or any combination thereof. 
     
     
         134 . (canceled) 
     
     
         135 . (canceled) 
     
     
         136 . The computer program product of  claim 126 , wherein said system comprising applying execution transformations to both of the prepared computer software code and the prepared execution environment during execution of a computer software code to improve tamper resistance and/or obscurity in a designated execution environment. 
     
     
         137 - 165 . (canceled)