Code Obfuscation By Reference Linking
A method of obfuscating executable computer code to impede reverse-engineering, by interrupting the software's execution flow and replacing in-line code with calls to subroutines that do not represent logical program blocks. Embodiments of the present invention introduce decoy code to confuse attackers, and computed branching to relocated code so that actual program flow cannot be inferred from disassembled source representations.
1 . A method for obfuscating executable computer code which derives from assembler source instructions, the method comprising:
breaking the assembler source instructions into a plurality of fragments, and entering each fragment of said plurality of fragments into a fragment database;
examining each of said plurality of fragments and excluding a fragment from said fragment database if at least one of the following conditions occurs:
said fragment has a fragment size smaller than a predetermined minimum fragment size;
said fragment contains stack-pointer modification instructions;
said fragment contains a branching instruction to a relative address outside the fragment;
assembler source instructions contain a branching instruction into said fragment from outside said fragment;
for each fragment remaining in said fragment database:
making a copy of said fragment in an area of program space of the assembler source instructions and appending a return instruction thereto;
replacing the fragment in the assembler source instructions with a call to said copy, followed by a jump; and
assembling the assembler source instructions into obfuscated executable code.
2 . The method of claim 1 , wherein a fragment is further excluded from said fragment database if said fragment does not have similar fragments elsewhere in said fragment database.
3 . The method of claim 1 , wherein said entering each fragment of said plurality of fragments into a fragment database comprises putting a pointer to a code fragment into said fragment database.
4 . The method of claim 2 , wherein said fragment has a similar fragment elsewhere in said fragment database if a fragment elsewhere in said fragment database is identical in assembler source instructions to said fragment.
5 . The method of claim 2 , wherein said fragment has a similar fragment elsewhere in said fragment database if a fragment elsewhere in said fragment database has identical has identical program action when assembled into executable code.
6 . The method of claim 1 , further comprising:
disassembling the executable computer code into assembler source instructions.
7 . The method of claim 1 , further comprising:
inserting decoy code into the assembler source instructions.
8 . The method of claim 1 , further comprising:
interleaving said copy in the assembler source instructions.
9 . The method of claim 1 , in which said call to said copy is a computed branch.
10 . The method of claim 1 , in which said jump is a computed branch.