Patent ID: 7620987

Claim:
A method in a computing device having a memory and a processor for protecting a program from malware, the method comprising: retrieving executable code of the program; creating a process in which the retrieved executable code of the program is to execute; loading the executable code into memory of the process; suspending execution of the process; generating a secret based at least in part on attributes of the computing device; seeding a random number generator with the generated secret; identifying a plurality of obfuscation techniques; for each of the identified obfuscation techniques, based at least in part on a random number generated by the random number generator, determining whether the obfuscation technique should be applied to the executable code, and when it is determined that the obfuscation technique should be applied to the executable code, selecting the obfuscation technique, and retrieving the code for the selected obfuscation technique; identifying transfer instructions and pointers within the executable code; applying the retrieved code for each of the selected obfuscation techniques to the executable code loaded in memory to generate an obfuscated executable code of the program; when it is determined that an identified transfer instruction needs to be fixed up in the obfuscated executable code of the program, fixing up the identified transfer instruction so that the behavior of the obfuscated executable code of the program is functionally equivalent to that of the retrieved executable code; and resuming the process so that the obfuscated executable code of the program is executed on the processor.