Patent Application
20110167407
1. Technical Field
The present disclosure relates to software source code obfuscation and more specifically to data reference protection.
2. Introduction
Software publishers often attempt to restrict access to portions of compiled software executables to thwart reverse engineering attempts while still allowing the executables to function properly. Reverse engineering is the practice of dissecting and/or analyzing software to understand how it works. On certain systems, reverse engineering can retrieve information stored within software such as data related to cryptographic keys or copy protection schemes. Reverse engineers can even tamper with the software itself or call specific portions of the software for unauthorized purposes.
In the field of security for open platforms, obfuscation is a desirable way to protect secure portions of code. Obfuscation is the process of making source code or machine code difficult to read and/or understand. Software programmers may obfuscate code for several reasons, one of which is security. Indeed, some designers of such platforms have an obligation to protect keys, hide which processes are running, etc. Attackers try to gain information that allows copies of the software to be made, or in other cases to extract sensitive information such as keys used to protect access.
If an attacker retrieves the location of well-known data, the attacker is able to locate all of the functions that access the well-known data by cross-referencing instructions. Therefore, making the well-known data harder for an attacker to locate or access increases security.
Additional features and advantages of the disclosure will be set forth in the description which follows, and in part will be obvious from the description, or can be learned by practice of the herein disclosed principles. The features and advantages of the disclosure can be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the disclosure will become more fully apparent from the following description and appended claims, or can be learned by the practice of the principles set forth herein.
Disclosed are systems, methods, and computer-readable storage media for obfuscating software code based on protecting data references.
The system 100 generates the ordered set of pools of pointers by linking pools of pointers together with pointers. The system 100 merges function input parameters together. The first pool in the ordered set of pools has a fixed address and links to a number of additional pools through entries in the pools. In this manner, the system 100 converts references to data (pointers) in the source code according to the approach of accessing the data through the pools of pointers. An attacker must follow all of the operations on the pools of pointers to access the data. Those of skill in the art will understand the use of pointers in writing source code to reference data or for other programming purposes.
In one embodiment, the system alters or modifies an existing generated set of pools by at least one of pool entry shuffling, pool chaining shuffling, and cross-pointer shuffling. A cross-pointer is a pointer to another pointer. Pool entry shuffling includes at least one of replicating, switching or moving pool entries within a pool. One approach for pool chaining shuffling includes identifying the first pool in the ordered set of pools with a fixed address and modifying the location of the next pool link within a pool. Cross-pointer shuffling can include at least one of addition of a cross-pointer, removal of a cross-pointer, replication of a cross-pointer, and switching or moving of a cross pointer.
A function to retrieve the data performs the following steps: (1) selects a pointer in a first pool in the ordered set of pools; (2) follows the selected pointer or selected next pointer to identify a next pool in the ordered set of pools; (3) defines the next pool as a current pool and iteratively selecting a next pointer in the current pool and returning to step (2) until a function indicates that the selected next pointer in the current pool points to the data or pointer.
In one aspect, the principles disclosed herein apply to a compiler which generates code according to the data reference obfuscation. In another aspect, the principles herein apply to a computing device such as is shown in
In order to describe the manner in which the above-recited and other advantages and features of the disclosure can be obtained, a more particular description of the principles briefly described above will be rendered by reference to specific embodiments thereof which are illustrated in the appended drawings. Understanding that these drawings depict only exemplary embodiments of the disclosure and are not therefore to be considered to be limiting of its scope, the principles herein are described and explained with additional specificity and detail through the use of the accompanying drawings in which:
Various embodiments of the disclosure are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustration purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without parting from the spirit and scope of the disclosure.
With reference to
The system bus 110 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. A basic input/output (BIOS) stored in ROM 140 or the like, may provide the basic routine that helps to transfer information between elements within the computing device 100, such as during start-up. The computing device 100 further includes storage devices 160 such as a hard disk drive, a magnetic disk drive, an optical disk drive, tape drive or the like. The storage device 160 can include software modules 162, 164, 166 for controlling the processor 120. Other hardware or software modules are contemplated. The storage device 160 is connected to the system bus 110 by a drive interface. The drives and the associated computer readable storage media provide nonvolatile storage of computer readable instructions, data structures, program modules and other data for the computing device 100. In one aspect, a hardware module that performs a particular function includes the software component stored in a tangible and/or intangible computer-readable medium in connection with the necessary hardware components, such as the processor 120, bus 110, display 170, and so forth, to carry out the function. The basic components are known to those of skill in the art and appropriate variations are contemplated depending on the type of device, such as whether the device 100 is a small, handheld computing device, a desktop computer, or a computer server.
Although the exemplary embodiment described herein employs the hard disk 160, it should be appreciated by those skilled in the art that other types of computer readable media which can store data that are accessible by a computer, such as magnetic cassettes, flash memory cards, digital versatile disks, cartridges, random access memories (RAMs) 150, read only memory (ROM) 140, a cable or wireless signal containing a bit stream and the like, may also be used in the exemplary operating environment. Tangible computer-readable storage media expressly exclude media such as energy, carrier signals, electromagnetic waves, and signals per se.
To enable user interaction with the computing device 100, an input device 190 represents any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech and so forth. The input device 190 may be used by the presenter to indicate the beginning of a speech search query. An output device 170 can also be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems enable a user to provide multiple types of input to communicate with the computing device 100. The communications interface 180 generally governs and manages the user input and system output. There is no restriction on operating on any particular hardware arrangement and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.
For clarity of explanation, the illustrative system embodiment is presented as including individual functional blocks including functional blocks labeled as a “processor” or processor 120. The functions these blocks represent may be provided through the use of either shared or dedicated hardware, including, but not limited to, hardware capable of executing software and hardware, such as a processor 120, that is purpose-built to operate as an equivalent to software executing on a general purpose processor. For example, the functions of one or more processors presented in
The logical operations of the various embodiments are implemented as: (1) a sequence of computer implemented steps, operations, or procedures running on a programmable circuit within a general use computer, (2) a sequence of computer implemented steps, operations, or procedures running on a specific-use programmable circuit; and/or (3) interconnected machine modules or program engines within the programmable circuits. The system 100 shown in
Any or all of the steps and/or modules can be integrated with or interact with a compiler.
The compiler 200 takes as input source code 202 for a computer program written in a programming language like ANSI C, Perl, Objective-C, Java, etc. The compiler 200 passes the code to the front end of the compiler 200 which includes the lexical analyzer 204 and the semantic analyzer or parser 206. At this stage or at any other stage in the compiler 200, a module shown or not shown can perform all or part of the steps outlined above. The compiler 200 then operates on the source 202 in the back end, which includes the code optimizer 208 and the code generator 210. Often the division between the front end and the back end of a compiler is somewhat blurred. The compiler 200 can include other modules and can appear in different configurations. Other possible front end components include a preprocessing module and a semantic analysis module, not shown. The front end produces an intermediate representation of the code which is passed to the back end of the compiler 200. The back end of a compiler 200 can include an optimizer 208 and a code generator 210. Finally, the code generator 210 produces machine code 212 or object code. A linker, not shown, can combine the output 212 from several related compiled projects into a single executable file. An obfuscation tool separate from the compiler 200 can process the machine code 212 according to all or part of the steps outlined above to produce modified or obfuscated machine code Likewise, an obfuscation tool can operate on source code 202 to produce modified or obfuscated source code which is passed to a regular, unmodified compiler 200. Additionally, an obfuscation tool can operate on code after the front end. In one aspect, a module in the compiler, a pre-processing tool, and/or a post-processing tool operating together perform the overall task of obfuscation based on protecting data references. Other compiler components and modules can be added within the spirit and scope of this disclosure.
Having disclosed some basic system components, the disclosure now turns to the exemplary method embodiment shown in
Next, an example algorithm to construct an ordered set of pools of pointers is discussed.
The pointer shuffling process 530 in
All of the operations on the pools or on the pointers are deterministic and fixed at the source code level, before the source code is compiled. A function analyzes the source code, detects the use of pointers and obfuscates the pointers using the process described here. This approach allows the loading of all data references into pools of pointers. Due to the shuffling, the system 100 obfuscates the pointer indices such that an attacker is forced to follow all of the operations performed on the pool of pointers in order to get to the data. This approach introduces a large amount of extra work for the attacker to gain access to data.
For example, consider a pointer p points to a fixed value in unobfuscated source code. One level of indirection exists to access the fixed value through pointer p. The system obfuscates the source code containing pointer p by loading pointer p into the first entry of the second pool. After the obfuscation, three levels of indirection exist to access the fixed value through pointer p. The first level of indirection is accessing the first pool, the second level of indirection is accessing the second pool through the first pool and the third level of indirection is following pointer p stored in the second pool to retrieve the fixed value. The system 100 added multiple levels of indirection to access the fixed value stored by p. Adding levels of indirection increase the security of the system since the attacker must complete more steps to access the data. Many variations and combinations of code obfuscation can be implemented. For example p could store a function input instead of a fixed value or the system could obfuscate the code so that p is stored in a different pool with a different number of indirections. This example should not be limiting in any way.
Next, the shuffling processes performed on the ordered set of pointers are discussed.
In
Step 0 in
In step 0, a function can lead through a path of the pools to retrieve the data. For example, a function could traverse a path from pool 1, using pool2_ptr, to pool 2, and go to pool 3 via pool3_ptr. For pool 3, the function could use pool4_ptr to find pool 4 and then use xptr2_1 to locate ptr2 in pool n, which points directly to data2. Other pointer paths such as moving from pool n to pool 2 via ptr1_2 or from pool 3 to pool 2 via xptr1_1 could be used. The multiple pointers in the pools can further confuse a hacker trying to access the data.
Step 1 illustrates the state of the pools after the system performs pool entry shuffling and cross-pointer addition. The system 100 updates the location of ptr4 between Step 0 and Step 1 by performing a pool entry shuffle. After the shuffle, pointer ptr4 is stored in block 1010 in Pool 1. Before the shuffle, pointer ptr4 was located in the first block of Pool 1. In Step 1, the system demonstrates cross-pointer addition by adding cross-pointer xptr4_1 to Pool 2 as is shown in block 1020. Prior to this addition, no references to ptr4 existed. Again, the system demonstrates cross-pointer addition by adding cross-pointer xptr1_3 to Pool 3 in block 1030. In addition to pointers xptr1_1 and xptr1_2, xptr1_3 points to ptr1.
In
Using the technique of pointer obfuscation creates a dependency between different functions within source code since they are using shared data.
When the system 100 reshuffles pools and utilizes shared data through multiple levels of indirection, the system 100 effectively creates a state machine representation. A state machine is a model of behavior composed of a finite number of states, transitions between those states, and actions. In
The obfuscation process discussed herein can add performance overhead, however it can be controlled by limiting the number of indirections to data and limiting the amount of data to which the solution applies. In terms of performance overhead, expensive memory access takes a greater amount of time to retrieve data from memory than an inexpensive memory access does. Access to the pointers located in the first pool does not lead to any performance overhead once they are set. The pools that are located the farthest away in memory are the most expensive to access in performance terms, but this is controlled by assigning the location of the most frequently used pointers to the closest pools. The expensive actions of this obfuscation process have been discussed above: pool entry shuffling, pool chaining shuffling and cross-pointer shuffling. On repetitive tasks requiring high performance, the number of calls to these three features can be lowered. A programmer can add flags explicitly designating portions of source code as higher performance or lower performance, or the system can automatically determine how to allocate expensive and inexpensive actions based on security, performance, memory constraints, and/or other considerations. Thus, one aspect of this disclosure relates to a variation of parameters which guide the system to implement an expensive, inexpensive, or hybrid obfuscation based on such factors as source code performance for particular portions of source code, desired level of protection for specific pieces of data (such as social security numbers and cryptographic keys), and so forth.
Embodiments within the scope of the present disclosure may also include tangible computer-readable storage media for carrying or having computer-executable instructions or data structures stored thereon. Tangible computer-readable storage media is non-transitory. Such computer-readable storage media can be any available media that can be accessed by a general purpose or special purpose computer, including the functional design of any special purpose processor as discussed above. By way of example, and not limitation, such computer-readable media can include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to carry or store desired program code means in the form of computer-executable instructions, data structures, or processor chip design. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or combination thereof) to a computer, the computer properly views the connection as a computer-readable medium. Thus, any such connection is properly termed a computer-readable medium. Combinations of the above should also be included within the scope of the computer-readable media.
Computer-executable instructions include, for example, instructions and data which cause a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Computer-executable instructions also include program modules that are executed by computers in stand-alone or network environments. Generally, program modules include routines, programs, components, data structures, objects, and the functions inherent in the design of special-purpose processors, etc. that perform particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of the program code means for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps.
Those of skill in the art will appreciate that other embodiments of the disclosure may be practiced in network computing environments with many types of computer system configurations, including personal computers, hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, and the like. Embodiments may also be practiced in distributed computing environments where tasks are performed by local and remote processing devices that are linked (either by hardwired links, wireless links, or by a combination thereof) through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.
The various embodiments described above are provided by way of illustration only and should not be construed to limit the scope of the disclosure. Those skilled in the art will readily recognize various modifications and changes that may be made to the principles described herein without following the example embodiments and applications illustrated and described herein, and without departing from the spirit and scope of the disclosure.
