Source: https://patents.google.com/patent/US20040151306?oq=6462713
Timestamp: 2018-03-21 17:06:06
Document Index: 478802224

Matched Legal Cases: ['arts 310', 'art 316', 'art 324', 'arts 320', 'arts 410', 'arts 420', 'arts 711', 'arts 722', 'art 722', 'art 732', 'art 732', 'art 731', 'art 728', 'art 737', 'art 728', 'art 737', 'art 728', 'art 737', 'art 737', 'art 728', 'arts 812', 'arts 832', 'art 832', 'art 836', 'arts 1152', 'arts 1141', 'arts 1172']

US20040151306A1 - Method of obfuscating computer instruction streams - Google Patents
Method of obfuscating computer instruction streams Download PDF
US20040151306A1
US20040151306A1 US10763881 US76388104A US2004151306A1 US 20040151306 A1 US20040151306 A1 US 20040151306A1 US 10763881 US10763881 US 10763881 US 76388104 A US76388104 A US 76388104A US 2004151306 A1 US2004151306 A1 US 2004151306A1
US10763881
US7322045B2 (en )
Raymond Kiddy
Kiddy Raymond R.
[0005]FIG. 1 shows one example of an obfuscation method according to one embodiment of the prior art. In operation 341 a typical compiler converts a unit of human readable source code 302 into a virtual machine instruction stream 304 which can be easily de-compiled into a version of the human readable source code. To obfuscate the virtual machine instruction stream 304, operation 343 breaks the stream 304 into a set of parts 310. These parts are transformed and padded with dummy instructions in operation 345. For example, part 316 is transformed into part 324, which is padded with dummy instructions 322. The transformations in operation 345 may include reversing loops, expanding loops, flow transformation, renaming identifiers, etc. After the transformation and padding, operation 347 assembles the set of transformed and padded parts 320 into a new instruction stream 330. The new instruction stream is obfuscated and more difficult to be de-compiled into a version of the human readable source code than the mechanically compiled instruction stream 304.
[0007]FIG. 2 shows a block diagram of an obfuscation method according to one example of the prior art. Operation 202, corresponding to the operation 343 in FIG. 1, breaks a virtual machine instruction stream into parts. Operation 204 transforms the parts; operation 206 pads the transformed parts with dummy instructions. Operations 204 and 206 correspond to the operation 345 in FIG. 1. Operation 208, corresponding to operation 347 in FIG. 1, assembles the padded and transformed parts into a new instruction stream.
[0018]FIG. 1 shows a method of obfuscating a computer instruction stream according to one example of the prior art.
[0019]FIG. 2 shows a block diagram of an obfuscation method according to one example of the prior art.
[0020]FIG. 3 shows a block diagram example of a data processing system which may be used with the present invention.
[0021]FIG. 4 shows a method of obfuscating computer instruction streams according to one embodiment of the present invention.
[0022]FIG. 5 shows a block diagram of an obfuscation method according to one embodiment of the present invention.
[0023]FIG. 6 shows another example of obfuscating computer instruction streams according to the present invention.
[0024]FIG. 7 shows a detailed example of interleaving parts from two computer instruction streams into an obfuscated stream.
[0025]FIG. 8 shows an example of obfuscating computer instruction streams according to the present invention where transformed and interleaved parts from two streams of instructions are interrelated.
[0026]FIG. 9 shows examples of executing computer instruction streams obfuscated using various methods of the present invention.
[0027]FIG. 10 shows a block diagram example of executing a combined computer instruction stream.
[0028]FIG. 11 shows an example of a machine readable media, which may be used to store software and data which when executed by a data processor system causes the system to perform various methods of the present invention.
[0030]FIG. 3 shows one example of a typical computer system which may be used with the present invention. Note that while FIG. 3 illustrates various components of a computer system, it is not intended to represent any particular architecture or manner of interconnecting the components as such details are not germane to the present invention. It will also be appreciated that network computers and other data processing systems which have fewer components or perhaps more components may also be used with the present invention. The computer system of FIG. 3 may, for example, be an Apple Macintosh computer.
[0036]FIG. 4 shows a method of obfuscating computer instruction streams according to one embodiment of the present invention. In operations 417 and 427 human readable source codes 412 and 422 are mechanically compiled into instruction streams 414 and 424, which can be easily de-compiled into a version of human readable source codes. To obfuscate them, the instruction streams 414 and 424 are broken into parts. The instruction stream 414 is broken into a set of parts 410; the instruction stream 424 is broken into a set of parts 420.
[0038]FIG. 5 shows a block diagram of an obfuscation method according to one embodiment of the present invention. Operations 512 and 522, corresponding to operations 419 and 429 in FIG. 4, break the operative instruction streams into parts. After the instruction streams are broken into parts, the parts are optionally transformed in operations 514 or 524. The optional transformations may involve reversing loops, expanding loops, flow transformation, renaming identifiers, changing the usage of variables, eliminating or substituting instructions, etc. Finally, the optionally transformed parts are interleaved into a new obfuscated instruction stream in operation 532. In other embodiments of the present invention, optional transformations may also take place before the virtual machine instruction streams are broken into parts.
[0042]FIG. 7 shows a detailed example of interleaving parts from two streams into an obfuscated stream. Stream 710, which shows a stream of byte codes for a method of a Java class, is the stream to be obfuscated. Stream 720 is a stream of byte codes for the purpose of obfuscation. Stream 720 may be a stream of byte codes for another method of the same class, or a stream of byte codes for a method of another class, or simply a copy of the stream 710 itself. Stream 710 can be broken into parts 711, 713, 715 and 717. Similarly, stream 720 can be broken into parts 722, 724, 726, and 728. The parts from streams 710 and 720 are interleaved into a stream 730, which performs the same logical operations as the stream 710. To prevent the parts from stream 720 from interfering the operation of the parts from stream 710, a number of transformations are performed. For example, part 722 is transformed into part 732 so that part 732 does not operate on the local variable used by part 731 which is taken from the stream to be obfuscated. Similarly, other parts from streams 710 and 720 are also transformed to avoid interference with each other. If part 728 is placed before part 737, the execution of part 728 makes part 737 not reachable, which is not a desirable side effect. However, if part 728 is placed after part 737, it will not be reachable due to part 737. Therefore, part 728 is discarded.
[0044]FIG. 8 shows an example of obfuscating computer instruction streams where transformed and interleaved parts from two streams of instructions are interrelated by obfuscation codes. Obfuscation codes are inserted into the obfuscated stream to relate the parts from different streams to prevent the reversal of interleaving. For example, obfuscation codes 842 and 848 in FIG. 8 are inserted into the obfuscated stream 830 to relate the parts from the instruction streams 810 and 820. Parts 812 and 826 are transformed into parts 832 and 836 in the obfuscated stream 830. Obfuscation code 842 is inserted to relate the part 832 from the stream 810 and the part 836 from the stream 820. An obfuscation code may access the variables used by different parts to interrelate them.
[0045]FIG. 9 shows examples of executing computer streams obfuscated using various methods of the present invention. FIG. 9 shows a number of computers, including servers 910, 930, 950 and clients 920, 940, 960. In one scenario, a combined and obfuscated stream, generated according to one of the methods of the present invention, is transferred from one computer for execution on a virtual machine. For example, the server 950 has mechanically complied computer instruction streams 951 and 952. The parts of the instruction streams 951 and 952 are interleaved into an obfuscated stream 956. The client 960 downloads the obfuscated stream 956 from server 950 to execute on a virtual machine 967. For instance, server 950 is a web server. The obfuscated stream 956 is a Java application or a Java applet. The client 960 runs a web browser, which downloads the Java application or applet for execution on a virtual machine.
[0048]FIG. 10 shows a block diagram example of executing a combined instruction stream. After receiving from another system a combined stream generated using various methods of the prevent invention, a computer executes the combined stream. Although FIG. 9 or FIG. 10 suggests that the client computer receives the obfuscated stream through a network, other media may be used to facilitate the transfer. For example, floppy diskettes, ROM or other removable media may be used to transfer or distribute the combined instruction stream.
[0049]FIG. 11 shows an example of a machine readable media, which may be used to store software and data which when executed by a data processor system causes the system to perform various methods of the present invention. As noted above, this executable software and data may be stored in various places including for example the ROM 107, the volatile RAM 105, the non-volatile memory 106 and/or the cache 104. Portions of this software and/or data may be stored in any one of these storage devices. The media 1110 for example may be primarily the volatile RAM 105 and the non-volatile memory 106 in one embodiment. The OS 1160 represents an operating system. Instruction streams 1150 and 1140 represent mechanically compiled virtual machine instruction streams. The obfuscated stream 1170 represents the combined stream with parts taken from instruction streams 1150 and 1140. Obfuscation program 1120 represents the computer instructions which when executed by the digital processing system cause the processing system to interleave the parts from operative instruction streams into a combined stream. For example, the parts 1152, 1154 and 1156 of the instruction stream 1150 and the parts 1141, 1143 and 1145 of the instruction stream 1140 are interleaved into an obfuscated stream 1170 which has parts 1172, 1174, 1176, 1171, 1173 and 1175. The virtual machine 1130 represents the instructions that implement a virtual machine on the processing system. The combined stream 1170 when executed on the virtual machine 1130 may perform the same set of logical operations as the instruction stream 1150.
breaking each of at least two operative instruction streams into a plurality of parts;
interleaving the parts into a new instruction stream.
inserting into the new instruction stream an obfuscation code that interrelates the parts from the operative instruction streams.
transforming at least one of the parts after said breaking and before said interleaving.
4. A method as in claim 3 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.
transforming one of the operative instruction streams before said breaking.
6. A method as in claim 1 wherein two of the operative instruction streams are the same.
means for breaking each of at least two operative instruction streams into a plurality of parts;
means for interleaving the parts into a new instruction stream.
8. A digital processing system as in claim 7 further comprising:
means for inserting into the new instruction stream an obfuscation code that interrelates the parts from the operative instruction streams.
9. A digital processing system as in claim 7 further comprising:
means for transforming at least one of the parts after said breaking and before said interleaving.
10. A digital processing system as in claim 9 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.
11. A digital processing system as in claim 7 further comprising:
means for transforming one of the operative instruction streams before said breaking.
12. A digital processing system as in claim 7 wherein two of the operative instruction streams are the same.
13. A machine readable media containing executable computer program instructions which when executed by a digital processing system cause said system to perform a method comprising:
14. A machine readable media as in claim 13 wherein the method further comprises:
15. A machine readable media as in claim 13 wherein the method further comprises:
16. A machine readable media as in claim 15 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.
17. A machine readable media as in claim 13 wherein the method further comprises:
18. A machine readable media as in claim 13 wherein two of the operative instruction streams are the same.
19. A processing system for combining computer instruction streams, said processing system comprising:
a memory coupled to said processor, said memory storing at least two operative instruction streams, said processor breaking each of the streams into a plurality of parts, said processor interleaving the parts into a new instruction stream.
20. A processing system as in claim 19 wherein said processor inserts into the new instruction stream an obfuscation code that interrelates the parts from the operative instruction streams.
21. A processing system as in claim 19 wherein said processor transforms at least one of the parts after breaking each of the streams and before interleaving the parts.
22. A processing system as in claim 21 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.
23. A processing system as in claim 19 wherein said processor transforms one of the operative instruction streams before breaking each of the streams.
24. A processing system as in claim 19 wherein two of the operative instruction streams are the same.
25. A machine readable media containing an obfuscated instruction stream which is executable by a digital processing system, said obfuscated instruction stream is produced by a method comprising:
26. A machine readable media as in claim 25 wherein the method further comprises:
inserting into the new instruction stream obfuscation codes that interrelate the parts from the operative instruction streams.
27. A machine readable media as in claim 25 wherein the method further comprises:
28. A machine readable media as in claim 27 wherein said transforming is such that the new instruction stream performs at least the same logical operations of one of the operative instruction streams.
29. A machine readable media as in claim 25 wherein the method further comprises:
transforming the operative instruction streams before said breaking.
30. A machine readable media as in claim 25 wherein two of the operative instruction streams are the same.
storing an obfuscated stream;
executing said obfuscated stream, wherein said obfuscated stream comprises parts which are interleaved, said parts having been taken from at least two operative instruction streams.
32. A method as in claim 31 wherein said obfuscated stream further comprises an obfuscation code that interrelates the parts from the operative instruction streams.
33. A method as in claim 31 wherein at least one of said parts has been transformed before said parts are interleaved and after said parts are taken from the operative instruction streams.
34. A method as in claim 31 wherein at least one of said parts has been so transformed before said parts are interleaved and after said parts are taken from the operative instruction streams that the obfuscated stream performs at least the same logical operations of one of the operative instruction streams.
35. A method as in claim 31 wherein one of the operative instruction streams has been transformed before said parts are taken from the operative instruction streams.
36. A method as in claim 31 wherein two of the operative instruction streams are the same.
37. A machine readable media containing executable computer program instructions which when executed by a digital processing system cause said system to perform a method comprising:
38. A machine readable media as in claim 37 wherein said obfuscated stream is stored temporarily in DRAM.
39. A machine readable media as in claim 37 wherein said obfuscated stream further comprises an obfuscation code that interrelates the parts from the operative instruction streams.
40. A machine readable media as in claim 39 wherein said obfuscated stream is stored temporarily in DRAM.
41. A machine readable media as in claim 37 wherein at least one of said parts has been transformed before said parts are interleaved and after said parts are taken from the operative instruction streams.
42. A machine readable media as in claim 41 wherein said obfuscated stream is stored temporarily in DRAM.
43. A machine readable media as in claim 37 wherein at least one of said parts has been so transformed before said parts are interleaved and after said parts are taken from the operative instruction streams that the obfuscated stream performs at least the same logical operations of one of the operative instruction streams.
44. A machine readable media as in claim 37 wherein one of the operative instruction streams has been transformed before said parts are taken from the operative instruction streams.
45. A machine readable media as in claim 44 wherein said obfuscated stream is stored temporarily in DRAM.
46. A machine readable media as in claim 37 wherein two of the operative instruction streams are the same.
47. A machine readable media as in claim 46 wherein said obfuscated stream is stored temporarily in DRAM.
US10763881 2001-07-25 2004-01-23 Method of obfuscating computer instruction streams Active 2023-01-13 US7322045B2 (en)
US09915827 US6694435B2 (en) 2001-07-25 2001-07-25 Method of obfuscating computer instruction streams
US10763881 US7322045B2 (en) 2001-07-25 2004-01-23 Method of obfuscating computer instruction streams
US09915827 Continuation US6694435B2 (en) 2001-07-25 2001-07-25 Method of obfuscating computer instruction streams
US20040151306A1 true true US20040151306A1 (en) 2004-08-05
US7322045B2 US7322045B2 (en) 2008-01-22
ID=25436311
US09915827 Active 2022-04-17 US6694435B2 (en) 2001-07-25 2001-07-25 Method of obfuscating computer instruction streams
US10763881 Active 2023-01-13 US7322045B2 (en) 2001-07-25 2004-01-23 Method of obfuscating computer instruction streams
US (2) US6694435B2 (en)
EP (2) EP1975784B1 (en)
DE (2) DE60236119D1 (en)
WO (1) WO2003010660A1 (en)
JP4905480B2 (en) * 2009-02-20 2012-03-28 富士ゼロックス株式会社 Program obfuscated program and program obfuscation apparatus
EP1410182B1 (en) 2008-12-17 grant
US20030023859A1 (en) 2003-01-30 application
EP1410182A1 (en) 2004-04-21 application
DE60230419D1 (en) 2009-01-29 grant
US7322045B2 (en) 2008-01-22 grant
EP1975784B1 (en) 2010-04-21 grant
EP1975784A1 (en) 2008-10-01 application
DE60236119D1 (en) 2010-06-02 grant
US6694435B2 (en) 2004-02-17 grant
WO2003010660A1 (en) 2003-02-06 application