Flexible instruction sets for obfuscated virtual machines

Patent metadata

Field	Value
Publication number	US-2016253189-A1
Application number	US-201514632879-A
Country	US
Kind code	A1
Filing date	Feb 26, 2015
Priority date	Feb 26, 2015
Publication date	Sep 1, 2016
Grant date	—

Abstract

A method for protecting computer software code is disclosed. In the embodiment, the method involves receiving instructions corresponding to computer software code for an application, the instructions including a first section of instructions to protect that is indicated by a first indicator and a second section of the instructions to protect that is indicated by a second indicator, rewriting the first section of instructions into a first section of virtual instructions, and rewriting the second section of instructions into a second section of virtual instructions, wherein the first section of instructions includes a first virtual instruction that corresponds to a first handler and the second section of virtual instructions includes a second virtual instruction that corresponds to a second handler, the first handler having different properties than the second handler.

First claim

What is claimed is:

1 . A method for protecting computer software code, the method comprising:
receiving instructions corresponding to computer software code for an application, the instructions including a first section of instructions to protect that is indicated by a first indicator and a second section of instructions to protect that is indicated by a second indicator; rewriting the first section of instructions into a first section of virtual instructions; and rewriting the second section of instructions into a second section of virtual instructions; wherein the first section of virtual instructions includes a first virtual instruction that corresponds to a first handler and the second section of virtual instructions includes a second virtual instruction that corresponds to a second handler, the first handler having different properties than the second handler.

2 . The method of claim 1 , wherein a property of the first handler corresponds to higher obfuscation and slower execution speed than the second handler.

3 . The method of claim 1 further comprising rewriting a third section of instructions that is indicated by a third indicator into a third section of virtual instructions, wherein the third section of virtual instructions includes a virtual instruction that corresponds to a third handler, the third handler having a degree of obfuscation and execution speed within a range defined by the first and second handler.

4 . The method of claim 1 , wherein virtual instructions of the first section of virtual instructions are from a first set of virtual instructions and virtual instructions of the second section of virtual instructions are from a second set of virtual instructions.

5 . The method of claim 1 , wherein a set of virtual instructions used to form the first section of virtual instructions is a default set of virtual instructions and a set of virtual instructions used to form the second section of virtual instructions is a set of virtual instructions indicated by the second section of instructions.

6 . The method of claim 1 , wherein the first and second indicators are operators embedded in the computer software code.

7 . The method of claim 1 , wherein the first section of virtual instructions are configured such that the first section of virtual instructions will be interpreted using different handlers than the second section of virtual instructions and the second section of virtual instructions are configured such that the second section of virtual instructions will be interpreted using different handlers than the first section of virtual instructions.

8 . The method of claim 1 , wherein the first handler and the second handler generate the same assembly code.

9 . A computer system comprising a one or more processors and memory, the memory comprising computer code that, when executed by the one or more processors, implements the method of claim 1 .

10 . A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, perform steps for protecting computer software code, the steps comprising:
receiving instructions corresponding to computer software code for an application, the instructions including a first section of instructions to protect that is indicated by a first indicator and a second section of instructions to protect that is indicated by a second indicator; rewriting the first section of instructions into a first section of virtual instructions; and rewriting the second section of instructions into a second section of virtual instructions; wherein the first section of virtual instructions includes a first virtual instruction that corresponds to a first handler and the second set of virtual instructions includes a second virtual instruction that corresponds to a second handler, the first handler having different properties than the second handler.

11 . The non-transitory computer-readable storage medium of claim 10 , wherein a property of the first handler corresponds to higher obfuscation and slower execution speed than the second handler.

12 . The non-transitory computer-readable storage medium of claim 10 further comprising instructions that, when executed by a computer, perform steps comprising rewriting a third section of instructions that is indicated by a third indicator into a third section of virtual instructions, wherein the third section of virtual instructions includes a virtual instruction that corresponds to a third handler, the third handler having a degree of obfuscation and execution speed within a range defined by the first and second handler.

13 . The non-transitory computer-readable storage medium of claim 10 , wherein virtual instructions of the first section of virtual instructions are from a first set of virtual instructions and virtual instructions of the second section of virtual instructions are from a second set of virtual instructions.

14 . The non-transitory computer-readable storage medium of claim 10 , wherein a set of virtual instructions used to form the first section of virtual instructions is a default set of virtual instructions and a set of virtual instructions used to form the second section of virtual instructions is a set of virtual instructions indicated by the second section of instructions.

15 . The non-transitory computer-readable storage medium of claim 10 , wherein the first and second indicators are operators embedded in the computer software code.

16 . The non-transitory computer-readable storage medium of claim 10 , wherein the first section of virtual instructions are configured such that the first section of virtual instructions will be interpreted using different handlers than the second section of virtual instructions and the second section of virtual instructions are configured such that the second section of virtual instructions will be interpreted using different handlers than the first section of virtual instructions.

17 . The non-transitory computer-readable storage medium of claim 10 , wherein the first handler and the second handler generate the same assembly code.

18 . A computer system comprising a one or more processors and memory, the memory storing computer code that, when executed by the one or more processors, implements the steps of claim 10 .

19 . A computer-implemented system for protecting computer software code, the system comprising:
one or more processors; and memory storing instructions that, when executed by the one or more processors, perform steps comprising:
receiving instructions corresponding to computer software code for an application, the instructions including a first section of instructions to protect that is indicated by a first indicator and a second section of instructions to protect that is indicated by a second indicator;
rewriting the first section of instructions into a first section of virtual instructions; and rewriting the second section of instructions into a second section of virtual instructions; wherein the first section of virtual instructions includes a first virtual instruction that corresponds to a first handler and the second set of virtual instructions includes a second virtual instruction that corresponds to a second handler, the first handler having different properties than the second handler.

20 . The computer-implemented system of claim 19 further comprising instructions that, when executed, perform steps comprising rewriting a third section of instructions that is indicated by a third indicator int

Assignees

• Nxp Bv

Inventors

• Teuwen Philippe

Classifications

• G06F21/563

  by source code analysis · CPC title

• G06F8/74

  Reverse engineering; Extracting design information from source code · CPC title

• G06F21/14 Primary

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title

• G06F9/455 Primary

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title