Abstract:
Method and apparatus for obfuscating computer software code, to protect against reverse-engineering of the code. The obfuscation here is of the part of the code that performs a Boolean logic operation such as an exclusive OR on two (or more) data variables. In the obfuscated code, each of the two variables is first modified by applying to it a function which deconstructs the value of each of the variables, and then the exclusive OR operation is replaced by an arithmetic operation such as addition, subtraction, or multiplication, which is performed on the two deconstructed variables. The non-obfuscated result is recovered by applying a third function to the value generated by the arithmetic operation. This obfuscation is typically carried out by suitably annotating (modifying) the original source code.

Description:
FIELD OF THE INVENTION 
       [0001]    This invention relates to computers, more specifically to computer security, and even more specifically to preserving the security of computer software using code obfuscation. 
       BACKGROUND 
       [0002]    The nature of computer software renders it susceptible to analysis and copying by third parties. There have been considerable efforts to enhance software security, see for instance U.S. Pat. No. 6,668,325 assigned to Intertrust Technologies Inc. There have been several efforts to provide technical protection for software. A well-known protection approach is called obfuscation, which typically relies on a rearrangement of the source code. Computer code (software or programs) comes in two chief types; the first is source code, which is as written by a human being (programmer) in a particular computer language. The source code itself is often then obfuscated. The other chief type is called object code or compiled code or binary code or machine code. This is the source code after having being processed by a special type of computer software program called a compiler; a compiler is routinely provided for each computer language. The compiler takes as input the alphanumeric character strings of the source code as written by the programmer, and processes them into a string of binary ones and zeros, which can then be operated on by a computer processor. 
         [0003]    It is also known to obfuscate the compiled (object) code. The term “code morphing” is also applied to obfuscating object code. This is typically achieved by completely replacing a section of the object code with an entirely new block of object code that expects the same machine (computer or processor) state when it begins execution as a previous code section and will leave with the same machine state after execution as does the original code (thereby being semantically equivalent code). However, typically a number of additional operations compared to those of the original code will be completed, as well as some operations with an equivalent effect, by the morphed code. Code morphing makes disassembly or decompiling of such a program much more difficult. This is typically the act of taking the machine code and transforming it back into source code, and is done by reverse engineers or “hackers” who wish to penetrate the object code, using a special decompiler program. A drawback with code morphing is that by unnecessarily complicating operations and hindering compiler-made optimizations, the execution time of the obfuscated object code is increased. Thus typically code morphing is limited to critical portions of a program and so is often not used on the entire computer program application. Code morphing is also well known for obfuscating copy protection or other checks that a program makes to determine whether it is a valid, authentic installation or a pirated copy, for security purposes. 
         [0004]    Therefore, typically the goal of obfuscation is to start with the original code and arrive at a second form of the code, which is semantically or logically equivalent from an input/output point of view. As pointed out above, this means that for any input to the code in the field of possible inputs, the output value of the code is the same for both the original code and the obfuscated code. Thus a requirement of successful obfuscation is to produce a semantically equivalent (but also protected) code to the original (unprotected) code. 
         [0005]    As well known, computer programs called obfuscators or tools perform the obfuscating; they transform a particular software application (program) in source or object code form into one that is functionally identical to the original, but is much more difficult for a hacker to penetrate, that is to decompile. Note that the level of security from obfuscation depends on the sophistication of the transformations employed by the obfuscator, the power of the available deobfuscation algorithms as used by the hacker, and the amount of resources available to the hacker. The goal in obfuscating is to provide many orders of difference between the cost (difficulty) of obfuscating vs. deobfuscating. 
         [0006]    Hence it is conventional that the obfuscation process is performed at one location or in one secure computer (machine) after the source code has been written. The obfuscated source code is compiled and then transferred to a second (insecure) computing device, where it is executed after installation in associated memory at the second computing device. (Note that the normal execution does not include any decompiling since there is no need on a machine-level basis to restore the source code. Decompiling is strictly done for reverse engineering purposes.) At the second (recipient) computing device, the obfuscated code is installed and then can be routinely executed by the processor at the second computing device. The obfuscated code is executed as is. Generally it is slower to execute than the original code. 
         [0007]    Implementations of security related computer code running on “open platform” (insecure) systems are often subject to attack in order to recover cryptographic materials (keys, etc.), cryptographic algorithms, etc. The attacks are also referred to here by the term “reverse-engineering”, which is the way to recover code internals from a software binary (object code). Open platform means that internal operations of the computing system are observable by an attacker. This also means that under some circumstances, the attacker can break into the computer programs, modify values, modify instructions, or inject code. 
         [0008]    Several solutions are known to protect computer software code against reverse-engineering. They are implemented to make more complex the work of attackers in understanding the process, or to hide cryptographic data or operation. 
         [0009]    In obfuscation, the code is typically re-written by a person referred to as a software developer (programmer) who reviews the source code and makes the necessary changes, or by using a software “tool” which does the same tasks as the developer, in a very complex way. Then an attacker must do substantial additional work to recover something (humanly) understandable from the object code. This obfuscation includes—for instance—re-writing loops, splitting basic blocs of instructions (adding a jump in the code, using predicates), flattening the control flow (not executing linear blocks of code), etc. 
         [0010]    In the field of digital content protection, hiding data is necessary since it helps keep some values, and what the program is doing, unknown to an attacker. The goal of obfuscation is to create computer code as hard to understand as possible for an attacker. For instance, assume that one wants to hide in computer memory data designated D that is used with a Boolean exclusive OR operation (the XOR), with another value designated X. The problem is how to compute X XOR D, without revealing the value of D? 
         [0011]    One known way to hide D, while computing X XOR D is:
       Store D′=D XOR M 1  in memory for a mask value M 1 ,   Compute X′=X XOR M 2  for a second mask value M 2 ,   Compute Y′=X′ XOR D′ (this is equal to X XOR D XOR M 1  XOR M 2 ),   Compute Y=Y′ XOR (M 1  XOR M 2 ) (which by definition is equal to X XOR D).       
 
         [0016]    It is assumed here that data (variables) X, D are expressed numerically, in binary (1&#39;s and 0&#39;s) form. 
         [0017]    The variables M 1  and M 2  are used to mask (hide) the values of D and X in the memory; an attacker who retrieves D′ in memory has to find M 1  to retrieve D. Furthermore, the value D′ may have been computed on a safe (secure) server not accessible to the attacker, such that it looks complicated to recover D and M 1 . 
         [0018]    However, this method has drawbacks:
       1. It is easy to retrieve the mask variables from several pairs (D, D′) of masked/unmasked data. Indeed, if an attacker is able to obtain a single data pair (D, D′), he can retrieve mask M 1  by computing:       
 
         [0000]      M1=D XOR D′
           Unmasking any other masked data (having the same mask value) is then easy.       2. The mask value M 1  can be computed from data in the code, since M 2  and (M 1  XOR M 2 ) must appear in the code in order to mask X and to unmask Y′.       
 
         [0022]    Note that in practice, the attack is not so easy, since implementation of this is done in a complex way with split data, fake operations, and it is not so easy in the middle of many operations to retrieve the useful (for the attacker) elements. 
       SUMMARY 
       [0023]    In accordance with the invention, an obfuscation technique is provided for computer source code. The original source code is modified by an obfuscation process applied by a software developer who reviews the code and modifies it, or does so by using a suitable tool. Thus rather than installing or downloading the original compiled code, instead the resulting obfuscated source code is compiled then downloaded or installed in the second (recipient) computer or computing device. Of course, computing devices here include for instance mobile telephones, cable television set top boxes, personal computers, laptop computers, personal digital assists, etc. The code cannot be, and so is not, deobfuscated at execution since that would degrade its security. As well known, there exist many programs semantically equivalent to the original code. They normally are not identical; that is what is meant by semantically or logically equivalent. Then this equivalent object code, which is executable, is installed on the recipient (target) device. 
         [0024]    The present methods are a way of masking data involved in an XOR or other Boolean logic operation. Notably the methods (i) compute an XOR using an arithmetic operation, with masked values; (ii) use masking techniques such that even if there are some known data pairs (D, D′), i.e. masked and unmasked data values, an attacker cannot unmask a new data value; (iii) are such that two data pieces D and X are masked differently, and use an unmasking technique that does not work on X′ or D′, but only on a combination of them. 
         [0025]    Described here is the operation of the tool to create the obfuscated code, the associated obfuscating method (which may be performed by a person manually without use of the tool if desired) applied to the code, and also the method of executing the resulting obfuscated code. 
         [0026]    These methods can be combined with other techniques known for obfuscating computer code, both source code and object code. 
     
    
     
       BRIEF DESCRIPTION OF THE FIGURE 
         [0027]      FIG. 1  shows a conventional computing device used in accordance with the invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0028]    The goal of the present method is to solve the above described technical problems. Instead of masking data with a Boolean mask (e.g., an XOR applied mask), the data is masked with a function designated here f, such that 
         [0000]        D′=f ( D ). 
         [0029]    In addition, two functions designated here g and h are provided that are linked (as explained below) to f, as well as a binary operator “op” (e.g., the arithmetic operations +, −, *, . . . ). The present disclosure describes functions f, g and h and op, used in order to compute X XOR D (or any other Boolean logic operation combining X and D), with the masked value D′=f(D) stored in memory. 
         [0030]    More generally, the present method is not limited to substituting for the Boolean logic exclusive OR operation, but may be used to substitute for the Boolean NOR and OR operations. The data designated X and D here may be, where the application program being obfuscated is a cryptographic process, a cryptographic key (or a byte of a key) and an associated portion (e.g. a byte) of plaintext or ciphertext data to which the key is applied. Typical such cryptographic processes are encryption and decryption. 
         [0031]    The obfuscation method uses the following steps (where the notation is as above):
       1. Compute X′=g(X)   2. Compute Y′=X′ op D′   3. Compute Y=h(Y′), where h is the recovering function       
 
         [0035]    Thereby:
       1. f is a function that masks the secret data D.   2. g is a function that masks the value X.   3. op is a way to compute the XOR of X′ and Y′, which are X and Y in masked form.   4. h is a function to unmask the previously computed result Y′, to recover Y.       
 
         [0040]    Protected computer code that has this obfuscation includes the code for the functions g and h, but not necessarily for function f. Indeed, masked data D′ may instead (in a client-server computer network environment) be computed on the (secure) server side to, or during code execution at a previous initilization time, or at the source code compilation time before execution (which is even more secure). It is understood that the remainder of the code is usually executed on the (insecure) client. 
         [0041]    Advantages are:
       1. Even given a data pair (D, D′), it is not possible to retrieve function f.       
 
         [0043]    With the known XOR-mask solution, a single pair (D, D′) of clear data, masked data allows recovery of the mask M 1  and so allows an attacker to break the obfuscation. Here, even if several such pairs (D, D′) are known, it is difficult for the attacker to obtain the clear value of another masked value E′ (with E′ different from all D′).
       2. From the obfuscated code, it is not possible to compute f 1  (the inverse of function f, i.e. the function f 1 (y) that returns x such that y=f(x)), unless one possesses D′=f(D) for all the different values of D. This is why it is preferred not to do this at runtime (code execution time), except if done at a previous initialization time.       
 
         [0045]    In this case, the attacker needs to execute, for each of these data values D′, the XOR computation as described above, with functions g and h, to obtain all the data pairs (D, D′) and to obtain the function f as a table. Contrary to the known simple Boolean mask approach, this is more difficult for the attacker when he wants to compute the plain (clear) data D or X, since functions g and h are also protected. 
         [0046]    In general for better security, functions g and h are not accessible at the same time or at the same place in the obfuscated code. At some points, the input of function g is masked and the code for function g contains internally this mask that has to be found by the attacker. For instance, it may not be necessary to recover Y from Y′ immediately, but other portions of the code may operate directly on Y′. Thereby function h may not be closely associated in the code with functions f and g. At other points, the output of function h is directly masked and computed with this later. Also note that both inputs and outputs can be masked, which makes it even more difficult for the attacker if he cannot rely on the exact values of g or/and h. 
         [0047]    The following describes functions f, g, and h, and operator op. This disclosure assumes the data is in pieces which are bytes (8 bits), but this is readily generalized to any word size (data length). 
         [0000]    Implementing an XOR with an Addition 
         [0048]    In a first embodiment of the present method function f is equal to function g. 
         [0049]    Function f: It is well known that any numeric data D can be uniquely represented in arithmetic (unsigned) base 2 as follows: 
         [0000]        D=Σ di  2 i  where  di  are the bits representing  D  (where each  di= 0 or 1) 
         [0050]    Σ denotes the sum from 0 to “some value” over the index i; i.e. D=d 0 +2*d 1 +4*d 2 + . . . For example, 7 is (1, 1, 1) in base 2, and 13 is (1, 1, 0, 1) in base 2. 
         [0051]    Keeping the same di, construct D′ from D (and denote this operation f(·)) as follows: 
         [0000]        D′=Σ di  3 i   =f ( D ) 
         [0000]    E.g., f( 7 )= 1 * 3   2 +1*3+1=13 in base 10, and f( 13 )=1*3 3 +1*3 2 +0*3+1=37 in base 10. 
         [0052]    Function f is an injective function, i.e. it can be inverted for its images. So for a given value y=f(x), one can efficiently compute the unique x. 
         [0053]    Operation op: Next, the code computes D XOR X, using D′=f(D) and X′=f(X). In this example, arithmetic addition is the “op” operation referred to above. 
         [0054]    One has: 
         [0000]        D′ op X′=D′+X ′=Σ( di+xi )3 i  
 
         [0055]    Since di and xi are each in the set {0, 1}, then (di+xi) is in the set {0,1, 2}. So there is no possible arithmetic carry when computing (di+xi) in base  3 . As there is no carry, given Σ(di+xi) 3 i , one can recover the different (di+xi) values, and consequently, the different ((di+xi) % 2) values, where “%” is the modulus operation. (Note that the XOR operation is an addition with no carry.) 
         [0056]    Function h: Thus, compute function h defined by: 
         [0000]        h ( a ):=write  a  as Σ ai  3 i , and return Σ( ai  % 2) 2 i  
 
         [0000]    and see that: 
         [0000]        D  XOR  X=h ( D′+X ′)
 
         [0057]    This computation can be implemented in the protected code by a table lookup. 
         [0058]    To summarize, in the obfuscated code the following steps compute (substitute for) D XOR X in the original code:
       1. D′=f(D)   2. X′=f(X)   3. Y′=D′+X′   4. Y=h(Y′)       
 
         [0063]    These steps implement an XOR Boolean logic operation by an arithmetic addition. It also has the security that even if several data pairs (D, D′) are known, the attacker is not able to unmask a new value D′ unless he knows obfuscation the techniques used. 
         [0064]    Generalization to other bases. One skilled in the art will understand that in other embodiments this is generalized to other arithmetic bases. E.g., define (for arithmetic base 5): 
         [0000]        D′=Σ di  5 i   =f ( D ) 
         [0000]      and 
         [0000]        h ( a ):=write  a  as Σ ai  5 i , and return Σ( ai  % 2)2 i .
 
         [0065]    Yet another embodiment uses a different arithmetic base, i.e. not only 3, for each bit. In fact, any number larger than 3 may be used as a base for any one bit. E.g., with respective bit bases 5, 7, 3, 4, 5, 6, 8, one computes: 
         [0000]        D′=d 0+8* d 1+8*6* d 2+8*6*5* d 3+8*6*5*4* d 4+8*6*5*4*3* d 5+8*6*5*4*3*7* d 6+8*6*5*4*3*7*5* d 7= f ( D ) 
         [0000]      and 
         [0000]        h ( a ):=write  a  as ( a 0+8* a 1+8*6* a 2+8*6*5* a 3+8*6*5*4* a 4+8*6*5*4*3* a 5+8*6*5*4*3*7* a 6+8*6*6*4*3*7*5* a 7), and return Σ( ai  % 2) 2 i .
 
         [0066]    This is more secure (since it is more complex) than using one base value for all data bits. Again, this calculation can be implemented in the protected (obfuscated) code as a table lookup. 
       Implementing an XOR by Multiplication 
       [0067]    Let a x  be the power operator, i.e. a*a*a . . . *a x times. 
         [0068]    The function f: Let pi be a set of 4 relatively small prime numbers, e.g. the prime number set {2,3,5,7}. One can represent any 4-bit number x as 
         [0000]        X′=f ( x )=( p 0 x0 )*( p 1 x1 )*( p 2     x2 )*( p 3     x3 ). 
         [0069]    The operator op: If one has D′=f(D) and X′=f(X), compute: 
         [0000]      X′*D′
 
         [0000]    and in fact, this is (p 0   x0+d0 )*(p 1   x1+d1 )*(p 2   x2+d2 )*(p 3   x3+d3 ), where the values (d 0 ,d 1 ,d 2 ,d 3 ) are the bits of D, and (x 0 ,x 1 ,x 2 ,x 3 ) are the bits of X. If this operation is performed on sufficiently large data words, there is no collision of values, since the decomposition into prime factors is unique. So this is an injective function. More precisely, one needs to have data words expressed as (p 0 *p 1 *p 2 *p 3 ) 2 . E.g., for the set P{2,3,5,7}, this is 210 2 =44100, so data words of 16 bits are adequate for good security. 
         [0070]    Function h: So it is possible to use the following recovery function h: 
         [0000]        h ( a ):=decompose  a  into prime factors: ( p 0 a0 )*( p 1 a1 )*( p 2 a2 )*( p 3 a3 ) and return Σ( ai  % 2) 2 i .
 
         [0071]    Function h can be implemented in the protected code as a table lookup. The reason to use relatively small primes is to keep the size of the table manageable. 
         [0072]    To summarize, in this embodiment the following steps compute D XOR X, where D and X are each data nibbles (i.e., 4 bits):
       1. D′=f(D)   2. X′=f(X)   3. Y′=D′*X′   4. Y=h(Y′)       
 
         [0077]    This embodiment implements an XOR logical operation with an arithmetic multiplication. It also has the protection that even if data pairs (D, D′) are known, the attacker is not able to unmask a new value D′. 
         [0078]    Generalization. Other embodiments are extensions of this method. One embodiment uses direct prime numbers (the smaller they are, the smallest the h table can be). Another embodiment puts more than one bit of x into a prime number p, e.g. use 
         [0000]        X′=f ( x )=( p 0 x0+2*x1 )*( p 1 x2+2*x3 )*( p 2 x4+2*x5 )*( p 3 x6+2*x7 ). 
         [0000]      and 
         [0000]        h ( a ):=decompose  a  into ( p 0 a0+2*a1 )*( p 1 a2+2*a3 )*( p 2 a4+2*a5 )*( p 3 a6+2*a7 ), and return Σ( ai  % 2)2 i .
 
         [0079]    It may be possible to replace the op (*) operation by a modular multiplication, i.e., op: (D′*X′) % N for some value N. One just needs to select a prime number p and value N such that all combinations are unique. 
         [0000]    Use with Other Techniques 
         [0080]    These embodiments are compatible with other known data hiding approaches, to improve effectiveness in further embodiment. Notably, one may:
       1. Randomize the order of the data bits before computing the functions f or g, and after computing the functions,   2. Permute values before or after computing the functions. For instance, one can use affine functions A: x→(ax+b) % c to mask the function f and g outputs and the function h inputs in the case of the addition operation. In the case of the multiplication operation, linear functions L: x→ax % c can be used.   3. Add randomness, i.e. pad the data that is input to some tables or functions with random bit values, and ignore the resulting bits from the padding bits.       
 
         [0084]    Yet another embodiment, instead of the addition operation for OP uses the arithmetic subtraction operation. 
         [0085]    However security of these embodiments is not perfect. Indeed, for any data value D, h(f(D))=D. So, using h on X′ directly, an attacker may recover the hidden value D. Furthermore, the function f applied on D and X is the same (i.e., f is equal to g). It is more secure to have differences between hiding X and D. 
       Making Functions f and g Different 
       [0086]    Consider the above embodiment using the addition operation. (The same could be done for the embodiment using the multiplication operations.) 
         [0000]    A first embodiment, with offsets: Let ui be 8 integer offset values (if x is a byte having 8 bits) and define: 
         [0000]        f ( x ): write  x  as Σ  xi  2 i , and return  f ( x )=Σ( xi+ui ) 5 i  
 
         [0087]    An extension to other numbers of bits is straightforward. 
         [0088]    Let vi be 8 integer offset values and define: 
         [0000]        g ( x ): write  x  as Σ  xi  2 i , and return  g ( x )=Σ( xi+vi ) 5 i  
 
         [0089]    The requirement is that ui+vi&lt;3 and ui≧0 and vi≧0, such that when one adds the two values xi, the sum is less than 5, i.e. there is no arithmetic carry in base 5. 
         [0090]    Function h: Thus compute function h defined by: 
         [0000]        h ( a ):=write  a  as Σ( ai ) 5′, compute  bi=ai−ui−vi,  and return Σ( bi  % 2) 2 i  
 
         [0091]    h can be implemented by a table lookup. 
         [0092]    To summarize, in this embodiment the following steps compute D XOR X, as above:
       1. D′=f(D)   2. X′=g(X)   3. Y′=D′+X′   4. Y=h(Y′)       
 
         [0097]    This embodiment implements an XOR logical operation using an addition. The advantage is that f and g are different, and that h cannot be used to invert f, i.e., h(D′) is not equal to D. 
       Multiple Functions 
       [0098]    Instead of offsets ui and vi, yet another embodiment uses any function from [0,1] to [0,5]. Suppose there are 8 such functions designated si( ) and ti( ) where si and ti are functions from [0, 1] to [0, 5] (one function for each of eight bits of data) so that: 
         [0000]        f ( x ): write  x  as Σ  xi  2 i  and return  f ( x )=Σ( si ( xi )) 5 i  
 
         [0000]      Define  g ( x ): write  x  as Σ  xi  2 i  and return  g ( x )=Σ( ti ( xi )) 5 i  
 
         [0099]    It is required that, for all i, for all xi and yi, 
         [0000]      the function (xi, yi)→si(xi)+ti(yi)
 
         [0000]    is injective. Thus there exists an inverse to this function, called w( ). This means that w(si(xi)+ti(yi))=(xi, yi). Such a set {si, ti, w} is called here a compatible set. 
         [0100]    Function h: Thus compute function h defined by: 
         [0000]        h ( a ):=write  a  as Σ( ai ) 5 i , compute ( xi, yi )= w ( a ), and return Σ(( xi+yi ) % 2) 2 i , where  h  can be implemented by a table lookup.
 
         [0101]    To summarize, the following steps compute D XOR X in this embodiment, as above:
       1. D′=f(D)   2. X′=g(X)   3. Y′=D′+X′   4. Y=h(Y′)       
 
         [0106]    This implements an XOR logical operation using an addition. The advantage here is that f and g are different, and that h cannot be used to invert f, i.e., h(D′) is not equal to D. Further compared to the previous embodiment, the functions f and g are more complex and harder to break, i.e. it is complicated to recover the set (si, ti, w). 
         [0107]    This embodiment with functions si and ti can be used with different arithmetic bases, not only base 5, as is explained above. 
         [0108]    Other embodiments are similar but use as the op multiplication. Others use different arithmetic bases (see above). Others use randomness, i.e. make some bits of D or D′ useless (key padding), to introduce uncertainty in the computations. 
         [0109]    One may also combine these embodiments with conventional Boolean data masks. Notably, this can be done on table lookup inputs and table lookup outputs. All embodiments may be generalized to XOR(or other logic) operations of more than 2 variables. Such operations are for instance used in the well known AES cipher for the mix column operation. 
         [0110]      FIG. 1  shows in a block diagram relevant portions of a computing device (system) in accordance with the invention for carrying out the present processes. This is, e.g., a computer, server, or part of such a device and includes conventional hardware components executing in one embodiment software (computer code) embodying the above examples of a code protection process. This code may be, e.g., in the C or C++ computer language or its functionality may be expressed in the form of firmware or hardware (circuitry) logic; writing such code or designing such logic would be routine in light of the above disclosure. 
         [0111]    Use of the obfuscating tool (which is written in any convenient computer language such as C or C++, and need not be in the same language as the code to be obfuscated), is as follows: First, the original source code to be obfuscated is input to the tool, to produce (“annotate”) the obfuscated source code as described above or, if no tool is used, the software developer does this manually by modifying the source code as described above. Then this obfuscated source code is conventionally compiled into object code. Generally, obfuscation of the code is followed by the code compilation, or the obfuscation is of code in an intermediate computer program language, but the compilation is still after the obfuscation. Then the obfuscated object code is conventionally distributed to users, such as in the form of an application program. From the user&#39;s standpoint, the obfuscated object code functions identically when executed on his computing platform to the original source code. 
         [0112]    Computer code in terms of the above described developer&#39;s obfuscating tool (if used) and the (conventional) compiler is conventionally stored in memory (computer readable storage medium, e.g., RAM or ROM) associated with a processor for in, a computing system, execution by the processor. The incoming source code to be protected is received at a port of the computing system and stored in a computer readable storage medium (memory, e.g., RAM) where it is coupled to the processor. The processor conventionally partitions the code into suitable sized blocks at a partitioning module. Other software (code) modules in the tool which are executed by the processor may carry out the obfuscation functionality set forth above. 
         [0113]      FIG. 1  thus illustrates a typical and conventional computing system  160  that may be employed to implement processing functionality in embodiments of the invention for (1) protecting (obfuscating) the code as described above or (2) executing the protected code (which is conventional in terms of the code execution). Computing systems of this type may be used in a computer server or user (client) computer in a computer network or other computing device, for example. Those skilled in the relevant art will also recognize how to implement embodiments of the invention using other computer systems or architectures. Computing system  160  may represent, for example, a desktop, laptop or notebook computer, hand-held computing device (personal digital assistant (PDA), cell phone, palmtop, etc.), mainframe, server, client, or any other type of special or general purpose computing device as may be desirable or appropriate for a given application or environment. Computing system  160  can include one or more processors, such as a processor. Processor  164  can be implemented using a general or special purpose processing engine such as, for example, a microprocessor, microcontroller or other control logic. In this example, processor  164  is connected to a bus  162  or other communications medium. 
         [0114]    Computing system  160  can also include a main memory  168 , such as random access memory (RAM) or other dynamic memory, for storing information and instructions to be executed by processor  164 . Main memory  168  also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor  164 . Computing system  160  may likewise include a read only memory (ROM) or other static storage device coupled to bus  162  for storing static information and instructions for processor  164 . 
         [0115]    Computing system  160  may also include information storage system  170 , which may include, for example, a media drive  162  and a removable storage interface  180 . The media drive  172  may include a drive or other mechanism to support fixed or removable storage media, such as flash memory, a hard disk drive, a floppy disk drive, a magnetic tape drive, an optical disk drive, a compact disk (CD) or digital versatile disk (DVD) drive (R or RW), or other removable or fixed media drive. Storage media  178  may include, for example, a hard disk, floppy disk, magnetic tape, optical disk, CD or DVD, or other fixed or removable medium that is read by and written to by media drive  72 . As these examples illustrate, the storage media  178  may include a computer-readable storage medium having stored therein particular computer software or data. 
         [0116]    In alternative embodiments, information storage system  170  may include other similar components for allowing computer programs or other instructions or data to be loaded into computing system  160 . Such components may include, for example, a removable storage unit  182  and an interface  180 , such as a program cartridge and cartridge interface, a removable memory (for example, a flash memory or other removable memory module) and memory slot, and other removable storage units  182  and interfaces  180  that allow software and data to be transferred from the removable storage unit  178  to computing system  160 . 
         [0117]    Computing system  160  can also include a communications interface  184 . Communications interface  184  can be used to allow software and data to be transferred between computing system  160  and external devices. Examples of communications interface  184  can include a modem, a network interface (such as an Ethernet or other network interface card (NIC)), a communications port (such as for example, a USB port), a PCMCIA slot and card, etc. Software and data transferred via communications interface  184  are in the form of signals which can be electronic, electromagnetic, optical or other signals capable of being received by communications interface  184 . These signals are provided to communications interface  184  via a channel  188 . This channel  188  may carry signals and may be implemented using a wireless medium, wire or cable, fiber optics, or other communications medium. Some examples of a channel include a phone line, a cellular phone link, an RF link, a network interface, a local or wide area network, and other communications channels. 
         [0118]    In this disclosure, the terms “computer program product,” “computer-readable medium” and the like may be used generally to refer to media such as, for example, memory  168 , storage device  178 , or storage unit  182 . These and other forms of computer-readable media may store one or more instructions for use by processor  164 , to cause the processor to perform specified operations. Such instructions, generally referred to as “computer program code” (which may be grouped in the form of computer programs or other groupings), when executed, enable the computing system  160  to perform functions of embodiments of the invention. Note that the code may directly cause the processor to perform specified operations, be compiled to do so, and/or be combined with other software, hardware, and/or firmware elements (e.g., libraries for performing standard functions) to do so. 
         [0119]    In an embodiment where the elements are implemented using software, the software may be stored in a computer-readable medium and loaded into computing system  160  using, for example, removable storage drive  174 , drive  172  or communications interface  184 . The control logic (in this example, software instructions or computer program code), when executed by the processor  164 , causes the processor  164  to perform the functions of embodiments of the invention as described herein. 
         [0120]    This disclosure is illustrative and not limiting. Further modifications will be apparent to these skilled in the art in light of this disclosure and are intended to fall within the scope of the appended claims.