Automatic computer program obfuscation system

Patent metadata

Field	Value
Publication number	US-9317667-B2
Application number	US-201313945264-A
Country	US
Kind code	B2
Filing date	Jul 18, 2013
Priority date	Feb 14, 2013
Publication date	Apr 19, 2016
Grant date	Apr 19, 2016

Abstract

A computer program obfuscating system including a processor to provide a computer program including at least one computer program variable, and add an opaque predicate to the computer program to obfuscate the computer program so that the opaque predicate added to the computer program comprises at least one polynomial including a polynomial P, during execution of the obfuscated computer program, the polynomial P is evaluated yielding at least one result including a first result R1, and during execution of the obfuscated computer program, the opaque predicate is evaluated based on the at least one result R1 such that a decision as to whether or not to perform the first command is dependent upon comparing the first result R1 to at least one value in accordance with a predetermined mathematical relationship. Related apparatus and methods are also included.

First claim

What is claimed is:

1. A computer program obfuscating system comprising a hardware processor including a memory, the hardware processor being operative to:
provide a computer program performing a plurality of commands including a first command, the computer program including at least one computer program variable used during execution of the computer program; and then
add an opaque predicate to the computer program to obfuscate the computer program so that:
the opaque predicate added to the computer program comprises at least one polynomial including a polynomial P in at least one indeterminate, the polynomial P being a degree two or more polynomial;
during execution of the obfuscated computer program, the polynomial P is evaluated by substituting the value or values of the at least one computer program variable, or a function of the value or values of the at least one computer program variable, into the polynomial P yielding at least one result including a first result R1; and
during execution of the obfuscated computer program, an interval of the polynomial P is selected, and the opaque predicate is evaluated based on the at least one result R1 such that a decision as to whether or not to perform the first command is dependent upon comparing the first result R1 to at least one value in accordance with a predetermined mathematical relationship, wherein the predetermined mathematical relationship is based on at least one property of the polynomial P and wherein the at least one property of the polynomial P includes at least one of the following: whether the sign of the polynomial P is positive or negative in the selected interval of the polynomial P; whether the polynomial P is monotonically increasing or monotonically decreasing in the selected interval of the polynomial P; and whether Q divides P where Q is a polynomial that is included in the opaque predicate; wherein
the at least one computer program variable includes a variable b and a variable c;
the processor is operative to determine whether the polynomial P is monotonically increasing or monotonically decreasing in the selected interval of the polynomial P; and
the processor is further operative to add the opaque predicate to the computer program such that during execution of the obfuscated computer program: a value of F(b) is calculated where F is a function which translates an input into the selected interval of the polynomial P; a value of F(c) is calculated; the polynomial P is evaluated by substituting the value of F(b) into the polynomial P yielding the first result R1; the polynomial P is evaluated by substituting the value of F(c) into the polynomial P yielding a second result R2; and the opaque predicate is evaluated based on the first result R1 and the second result R2 such that the decision as to whether or not to perform the first command is dependent upon comparing the first result R1 and the second result R2 to the at least one value in accordance with the predetermined mathematical relationship.

2. The system according to claim 1 , wherein adding the opaque predicate to the computer program does not change the functionality of the computer program regarding the outputs of the computer program.

3. The system according to claim 1 , wherein the processor is operative to add the opaque predicate to the computer program such that during execution of the obfuscated computer program, the opaque predicate is evaluated based on the first result R1 and the second result R2 such that the decision as to whether or not to perform the first command is dependent upon whether the sign of

R
⁢

⁢
1

-

R
⁢

⁢
2

F
⁡

(
b
)

-

F
⁡

(
c
)

is positive or negative.

4. The system according to claim 1 , wherein the processor is operative to add the opaque predicate to the computer program to obfuscate the computer program so that during execution of the computer program, evaluation of the opaque predicate yielding the decision as to whether or not to perform the first command is arranged so that the decision outcome is the same whatever the value or values of the at least one computer program variable.

5. The system according to claim 4 , wherein the decision as to whether or not to perform the first command is arranged, so that the decision outcome is the same whatever the value or values of the at least one computer program variable, by configuring the predetermined mathematical relationship based on at least one property of the polynomial P.

6. The system according to claim 5 , wherein the at least one property of the polynomial includes the roots of the polynomial P.

7. The system according to claim 1 , wherein:
the processor is operative to determine whether the sign of the polynomial P is positive or negative in a certain interval of the polynomial P;
the at least one computer program variable includes a variable b; and
the processor is operative to add the opaque predicate to the computer program such that during execution of the obfuscated computer program:
a value of F(b) is calculated where F is a function which translates b into the certain interval of the polynomial P; and
the polynomial P is evaluated by substituting the value of F(b) into the polynomial P yielding the first result R1.

8. The system according to claim 7 , wherein the processor is operative to add the opaque predicate to the computer program such that during execution of the obfuscated computer program, the opaque predicate is evaluated based on the first result R1 such that the decision as to whether or not to perform the first command is dependent upon whether the sign of the first result R1 is positive or negative.

9. The system according to claim 1 , wherein:
the processor is operative to add the opaque predicate to the computer program such that the at least one polynomial added to the computer program includes a polynomial Q in at least one indeterminate such that Q divides P; and
the processor is operative to add the opaque predicate to the computer program such that during execution of the obfuscated computer program:
the polynomial P is evaluated by substituting the value or values of the at least one computer program variable, or a function of the value or values of the at least one computer program variable, into the polynomial P yielding the first result R1;
the polynomial Q is evaluated by substituting the value or values of the at least one computer program variable, or a function of the value or values of the at least one computer program variable, into the polynomial Q yielding a second result R2; and
the opaque predicate is evaluated based on the first result R1 and the second result R2 such that the decision as to whether or not to perform the first command is dependent upon comparing the first result R1 and the second result R2 to the at least one value in accordance with the predetermined m

Assignees

• Cisco Tech Inc
• Cisco Tech Inc

Inventors

• Cain Harel
• Adini Guy
• Moshe Nir

Classifications

• G06F21/14 Primary

  against software analysis or reverse engineering, e.g. by obfuscation · CPC title