Patent Application
20090235088
The present invention relates to a software protection technique, and more particularly to a program conversion device converting a given program to a program more difficult to analyze, an execution support device supporting execution of the converted program, and a method and a computer program for the same.
Study on software protection has actively been conducted in recent years. Software protection collectively refers to techniques for protecting a software system against attacks such as tampering, analysis, copying, and reuse (illegal use) of software, and includes constituent technologies such as obfuscation, encryption, software diversity, electronic watermark, and birthmark.
Among these software protection techniques, from a viewpoint of invulnerability to attack, program obfuscation, which is a method of making a program itself difficult to analyze without an additional protection scheme, has particularly attracted attention.
Obfuscation is a technique for converting a given program to a more complicated program, and includes layout obfuscation, data obfuscation, control flow obfuscation, and the like. Though an obfuscated program has a function the same as the program before obfuscation, understanding or analysis thereof has been made more difficult. Examples of related techniques include: Japanese Patent Laying-Open No. 2005-49925 (Patent Document 1); Japanese Patent Laying-Open No. 2004-192068 (Patent Document 2); U.S. Pat. No. 6,102,966 (Patent Document 3); Toshio Ogiso and Yusuke Sakabe and Masakazu Soshi and Atsuko Miyaji, “Software obfuscation on a theoretical basis and its implementation,” IEICE Transactions on Fundamentals, Vol. E86-A, No. 1, pp. 176-186, January 2003 (Non-Patent Document 1); and Yusuke Sakabe and Masakazu Soshi and Atsuko Miyaji, “Java™ Obfuscation with a Theoretical Basis for Building Secure Mobile Agents,” Lecture Notes in Computer Science, Vol. 2828, pp. 89-103, 2003 (Non-Patent Document 2), as shown below.
Patent Document 1: Japanese Patent Laying-Open No. 2005-49925
Patent Document 2: Japanese Patent Laying-Open No. 2004-192068
Patent Document 3: U.S. Pat. No. 6,102,966
Non-Patent Document 1: Toshio Ogiso and Yusuke Sakabe and Masakazu Soshi and Atsuko Miyaji, “Software obfuscation on a theoretical basis and its implementation,” IEICE Transactions on Fundamentals, Vol. E86-A, No. 1, pp. 176-186, January 2003.
Non-Patent Document 2: Yusuke Sakabe and Masakazu Soshi and Atsuko Miyaji, “Java™ Obfuscation with a Theoretical Basis for Building Secure Mobile Agents,” Lecture Notes in Computer Science, Vol. 2828, pp. 89-103, 2003.
When a cracker analyzes, tampers or illegally uses a program, the cracker typically locates a name included in the program (a variable name, a function name, a class name, a method name, and the like) and understands the program, relying on the name. In order to prevent such an act, obfuscation by replacing a name that appears in the program with another very unintelligible name should be carried out.
On the other hand, static replacement of a name of a system API (Application Program Interface) used by the program or system definition such as a library function, a library class and a library method with another name is impossible. This is because system definition is given a fixed name (that cannot be changed), for allowing general-purpose use in a large number of computer environments.
Non-Patent Document 1 is directed to a technique for hiding method invocation processing, however, this technique cannot hide a name of a method group that may be invoked. Non-Patent Document 2 is directed to a technique for hiding a method to be invoked by allowing overload of methods in a class, however, this processing cannot be performed on invocation of a library method and hiding thereof is not successful. In addition, neither of a type of an argument and a type of a return value of an invoked method can be hidden. As the method to be invoked can be estimated from information relevant to the type of the argument or the like, a degree of obfuscation cannot be increased without hiding these types. Mere modification of the type, however, hinders execution of the obfuscated program, and therefore, it has been difficult to modify or erase the type.
Therefore, even with the techniques according to Patent Documents 1 to 3 or Non-Patent Documents 1 to 2 described above, it has been impossible to simultaneously achieve hiding of arbitrary method invocation, hiding of a name of an arbitrary module, and hiding of a type of an argument and a type of a return value of a module to be invoked, and it has namely been impossible to increase a degree of obfuscation of a program up to a certain level or higher.
The present invention was made to solve the above-described problems, and a first object is to provide a program conversion device for hiding processing of system definition included in a program and automatically converting the program to a program difficult to analyze, by encrypting in advance a class name, a method name and a field (variable) name and converting a type of a method to be invoked and a type of an argument, as well as a method and a computer program therefor.
A second object is to provide an execution support device capable of decrypting an encrypted name and carrying out dynamic method invocation and reference to a value in a field/assignment of a value to a field, in order to support execution of a body program that has been converted by the program conversion device and the like such that analysis thereof is made difficult, as well as a method and a computer program therefor.
According to one aspect of the present invention, a program conversion device for obfuscating a body program includes: an invocation modification unit modifying description of method invocation of the body program to description of dynamic invocation; and an encryption unit modifying the body program by encrypting a character string designating the dynamic invocation after modification by the invocation modification unit.
Preferably, the program conversion device further includes: a field modification unit modifying description referring to a field or description assigning a value to a field to description dynamically referring to a field or description dynamically assigning a value to a field; and the encryption unit modifying the body program by encrypting a name of the field included in description after modification by the field modification unit.
More preferably, the invocation modification unit makes modification such that the description of the dynamic invocation is invoked via a method in another class, and the field modification unit makes modification such that the description dynamically referring to the field or the description dynamically assigning the value to the field is carried out via the method in another class.
More preferably, the program conversion device further includes a variable type modification unit erasing a type of a variable included in the body program.
More preferably, the program conversion device further includes a key storage unit storing, in another class, a key for decrypting the character string encrypted by the encryption unit.
According to another aspect of the present invention, an execution support device supporting execution of an obfuscated body program includes: a decryption unit decrypting, in response to dynamic invocation of a method from the obfuscated body program, a character string from an encrypted value included in the invocation; and an execution unit executing the method using the character string decrypted by the decryption unit.
Preferably, the execution support device further includes: the decryption unit decrypting, in response to a request for dynamic reference to a field or dynamic assignment to a field from the obfuscated body program, a name of the field; and a field access unit carrying out reference to the field or assignment to the field by using the name decrypted by the decryption unit.
According to yet another aspect of the present invention, a program conversion method causing a computer to obfuscate a body program includes the steps of: modifying method invocation described in the body program to dynamic invocation; and modifying the body program by encrypting a character string designating the dynamic invocation after modification.
According to yet another aspect of the present invention, an execution support method causing a computer to support execution of an obfuscated body program includes the steps of: decrypting, in response to dynamic invocation of a method from the obfuscated body program, a character string from an encrypted value included in the invocation; and executing the method using the decrypted character string.
According to yet another aspect of the present invention, a computer program for causing a computer to perform a program conversion method for obfuscating a body program is provided, and the program conversion method includes the steps of: modifying method invocation described in the body program to dynamic invocation; and modifying the body program by encrypting a character string designating the dynamic invocation after modification.
According to yet another aspect of the present invention, a computer program causing a computer to perform an execution support method for supporting execution of an obfuscated body program is provided, and the execution support method includes the steps of: decrypting, in response to dynamic invocation of a method from the obfuscated body program, a character string from an encrypted value included in the invocation; and executing the method using the decrypted character string.
According to one aspect of the present invention, modification is made such that method invocation in the body program is dynamically carried out, and thereafter the name of the method designated in dynamic invocation is encrypted. Therefore, which method is invoked can be hidden and understanding of the program can be made difficult.
In addition, modification is made such that description of reference/assignment to the field in the body program is carried out via a method in another class, and thereafter the name of the field is handled with the name thereof being encrypted. Therefore, to which field reference or assignment is made can be hidden and understanding of the program can be made difficult.
Moreover, as the variable type modification unit modifies the type of the variable included in the body program, information on types of all variables that appear in the program, such as a type of an argument or a return value, can be hidden and understanding of the program can further be made difficult.
Further, as the invocation modification unit and the field modification unit make modification such that invocation modified to be dynamic or description of reference to the field or assignment to the field is carried out via a method in another class, another class can support execution of the obfuscated body program.
According to another aspect of the present invention, the decryption unit decrypts, in response to method invocation from the obfuscated body program, the character string from the encrypted value included in the invocation, and the execution unit executes the method using the decrypted character string. Thus, execution of the body program obfuscated by the program conversion device or the like can be supported.
In addition, the decryption unit decrypts the name of the field in response to a request for reference to the field or assignment to the field from the obfuscated body program, and the field access unit refers to the field or carries out assignment to the field by using the decrypted name. Thus, support in execution of the body program converted by the program conversion device or the like can further be facilitated.
1 computer main unit; 2 display device; 3 FD drive; 4 FD; 5 keyboard; 6 mouse; 7 CD-ROM device; 8 CD-ROM; 9 network communication device; 10 CPU; 11 ROM; 12 RAM; 13 hard disk; 21 program conversion device; 22 execution support device; 23 body program; 24 body program after conversion; 31 access restriction modification unit; 32 method invocation modification unit; 33 field reference/assignment modification unit; 34 variable type modification unit; 35 encryption unit; 36 character string storage unit; 41 instance generation unit; 42 method execution unit; 43 field reference unit; 44 field assignment unit; and 45 decryption unit.
A program conversion device in the embodiment of the present invention converts an original program to a program utilizing dynamic invocation, such that method invocation and reference/assignment to a field in a program described in an object-oriented language such as Java™ are hidden and a type of a variable is modified. Then, an execution support device interprets invocation or the like of the converted program and executes the method. The execution support device is provided as a class that supports execution of a body program such as dynamic invocation, and hereinafter also referred to as DynamicCaller class. In addition, an embodiment in which a method in another class, modification to which is made so that invocation or the like is made via the same, serves as the execution support device in the program conversion device is also possible.
Computer main unit 1 shown in
An access modifier is present for a member (a field and a method) in a class of the object-oriented language. The access modifier defines an allowable range of access to a field or a method, and includes public, protected and private. Access restriction modification unit 31 sets all access modifiers for members in the class to public. As all methods are thus invoked via DynamicCaller class, DynamicCaller class can access to any member in the class.
In general, the program described in the object-oriented language operates by creating an object by creating an instance of the class, and by sending a message to that object. Definition of the class can dynamically be modified during execution of the program by using a metaclass. In the embodiment of the present invention, such dynamic invocation is utilized.
For example, in a case of Java™ language, java™.lang.Class class corresponds to a metaclass, and an instance of Class class can be obtained by giving a character string indicating a class name to a forName static method in Class class. Then, a newInstance method is executed with respect to the obtained instance of Class class, so that an object of the corresponding class can be generated. In addition, by obtaining a java™.lang.reflect.Method object from an instance of Class class, a method to be executed can be determined from the given character string. Dynamic invocation of the method can thus be carried out.
Method invocation unit 32 modifies body program 23 by using such a metaclass, such that a process from generation of an object to execution of a method is performed by giving a character string.
In addition, in the embodiment of the present invention, polymorphism representing one important characteristic of object-oriented is used to make program analysis more difficult. Polymorphism means that objects different in class operate differently with respect to the same message. Specifically, if objects different in class are present in the same type of variables, an operation may be different depending on an object present in the variable and a result of execution may be different.
In the embodiment of the present invention, a metaclass is obtained from an object, definition of a method or a field is obtained from that metaclass, and thereafter processing of these is performed. Therefore, if the object present in the variable is the same as that before program conversion (before obfuscation) even though the type information is hidden, an operation of the body program is not affected. Here, variable type modification unit 34 modifies the type of the member in the class to a root class in a class hierarchy, so that the type information of the body program is erased and analysis of the program can be made more difficult.
Encryption unit 35 encrypts a character string such as a class name and a method name modified by method invocation modification unit 32 and field reference/assignment modification unit 33, for modification to an encrypted name. Encryption unit 35 may be divided into a first encryption unit encrypting a method name modified by method invocation modification unit 32 and a second encryption unit encrypting a field name modified by field reference/assignment modification unit 33. In the present embodiment, though a common key encryption is employed as an encryption system, symmetric key encryption or a hash function may be employed for encryption. Where the common key encryption system and the symmetric key encryption system are employed, a decryption key should be stored in the program conversion device or the execution support device. Where the hash function is employed, decryption of a character string before hashing should be enabled, by storing a table containing the character string before hashing in execution support device 22.
Initially, access restriction modification unit 31 obtains body program 23 (S11) and modifies restriction on access to all methods and fields to public (S12). Body program 100 before conversion shown in
Thereafter, method invocation modification unit 32 modifies every method invocation to invocation via DynamicCaller class 22 (S13). In the embodiment of the present invention, dynamic invocation may be carried out without using a method in another class, that is, DynamicCaller class. Here, a processing function of DynamicCaller should be implemented by the body program.
In addition, as shown in description 202, by executing a newInstance method via DynamicCaller class 22, an instance of HelloWorld class is generated and the generated instance is assigned to a variable o1. Then, a hello method in HelloWorld class is invoked via DynamicCaller class 22. Here, an instance for invoking the method is variable o1.
Thereafter, field reference/assignment modification unit 33 makes modification such that reference to a value in the field/assignment of a value to the field present in body program 23 (get/set) is all carried out via DynamicCaller 22 (S14).
Thereafter, variable type modification unit 34 modifies all fields and types of local variables to Object class, which is the root class in the class hierarchy (S15).
Thereafter, encryption unit 35 modifies a name within body program 23 to an encrypted name, by encrypting a class name, a method name and the like (S16).
Thereafter, encryption unit 35 outputs a body program after conversion 24 as shown in
Instance generation unit 41 generates an instance of a target class from a metaclass, in response to a request from body program after conversion 24. Namely, instance generation unit 41 extracts an encrypted value included in the request from body program after conversion 24, and decryption unit 45 decrypts the value so as to obtain the name before encryption. Then, instance generation unit 41 generates an instance based on the name before encryption, and returns the generated instance to body program after conversion 24.
Method execution unit 42 refers to the metaclass in response to invocation from body program after conversion 24 and executes the designated method in the target class. Namely, method execution unit 42 extracts the encrypted value included in the invocation from body program after conversion 24, and decryption unit 45 decrypts the value so as to obtain the name before encryption. Then, method execution unit 42 executes the method based on the name before encryption, and returns the return value of the executed method to body program after conversion 24.
Field reference unit 43 refers to the metaclass in response to the request from body program after conversion 24 and refers to the designated field in the target class. Namely, field reference unit 43 extracts the encrypted value included in the request from body program after conversion 24, and decryption unit 45 decrypts the value so as to obtain the name before encryption. Then, field reference unit 43 refers to the value in the field stored in standard library based on the name before encryption and returns the value in the field to body program after conversion 24.
Field assignment unit 44 refers to the metaclass in response to the request from body program after conversion 24 and assigns a value to the designated field in the target class. Namely, field assignment unit 44 extracts the encrypted value included in the request from body program after conversion 24, and decryption unit 45 decrypts the value so as to obtain the name before encryption. Then, field assignment unit 44 assigns the value to the field stored in standard library or the like based on the name before encryption. It is noted that field assignment unit 44 returns nothing to body program after conversion 24.
As described above, according to the program conversion device in the present embodiment, method invocation in all classes is converted to dynamic invocation and the character string used for dynamic invocation is encrypted. Therefore, method invocation present in the body program can be hidden and understanding of the program can be made difficult.
In addition, as the field name used when the value in the field is referred to/the value is assigned to the field is encrypted, access to the field can be hidden and understanding of the program can be made more difficult.
Moreover, as the types of variables (type of argument and type of return value) are all modified to the root class in the class hierarchy, the type of the variable can be hidden and understanding of the program can be made more difficult.
According to the execution support device in the present embodiment, decryption unit 45 obtains an original name of an encrypted name, and the obtained original name is used to carry out generation of an instance, execution of a method, reference to a field, and assignment to the field. Therefore, execution of body program after conversion 24 by the program conversion device can be supported.
It should be understood that the embodiments disclosed herein are illustrative and non-restrictive in every respect. The scope of the present invention is defined by the terms of the claims, rather than the description above, and is intended to include any modifications within the scope and meaning equivalent to the terms of the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2005-171372 | Jun 2005 | JP | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/JP2006/311504 | 6/8/2006 | WO | 00 | 12/10/2007 |
