Software self-defense systems and methods
View Patent ↗Systems and methods are disclosed for protecting a computer program from unauthorized analysis and modification. Obfuscation transformations can be applied to the computer program's local structure, control graph, and/or data structure to render the program more difficult to understand and/or modify. Tamper-resistance mechanisms can be incorporated into the computer program to detect attempts to tamper with the program's operation. Once an attempt to tamper with the computer program is detected, the computer program reports it to an external agent, ceases normal operation, and/or reverses any modifications made by the attempted tampering. The computer program can also be watermarked to facilitate identification of its owner. The obfuscation, tamper-resistance, and watermarking transformations can be applied to the computer program's source code, object code, or executable image.
1. A method performed by a computer system comprising a processor and a non-transitory computer-readable storage medium storing instructions that when executed by the processor, cause the computer system to perform the method, the method comprising:
inserting a plurality of primers in a computer program;
compiling the computer program to generate an executable computer program;
customizing the executable computer program to generate a customized executable computer program, wherein the customizing is configured to preserve the plurality of primers;
removing the plurality of primers from the customized executable computer program;
transmitting the customized executable computer program with the plurality of primers removed to a client computer system; and
transmitting a patch file to the client computer system, the patch file comprising the plurality of primers,
wherein the patch file is configured to be merged with the customized executable computer program with the plurality of primers removed by the client computer system.
2. The method of claim 1 , wherein the method further comprises:
prior to transmitting the customized executable computer program with the plurality of primers removed, encrypting the customized executable computer program.
3. The method of claim 1 , wherein customizing the executable program code comprises obfuscating the executable program code.
4. The method of claim 1 , wherein the customizing the executable program code comprises identifying the plurality of primers based on one or more flags associated with the plurality of primers, the one or more flags indicating portions of the executable computer program that should not be modified.
5. The method of claim 1 , wherein the plurality of primers each comprise assembly language patterns.
6. The method of claim 1 , wherein the plurality of primers comprise primers selected from a predetermined set of primer types.
7. The method of claim 1 , wherein the computer program comprises a source code computer program.
8. The method of claim 1 , wherein the computer program comprises a binary code computer program.
9. The method of claim 1 , wherein the customizing is performed by a customization tool, the method further comprising:
providing an indication to the customization tool of one or more locations of the plurality of primers.
10. A non-transitory computer-readable storage medium storing instructions that when executed by a system comprising a processor, cause the system to perform a method comprising:
inserting a plurality of primers in a computer program;
compiling the computer program to generate an executable computer program;
customizing the executable computer program to generate a customized executable computer program, wherein the customizing is configured to preserve the plurality of primers;
removing the plurality of primers from the customized executable computer program;
transmitting the customized executable computer program with the plurality of primers removed to a client computer system; and
transmitting a patch file to the client computer system, the patch file comprising the plurality of primers,
wherein the patch file is configured to be merged with the customized executable computer program with the plurality of primers removed by the client computer system.
11. The non-transitory computer-readable storage medium of claim 10 , wherein the method further comprises:
prior to transmitting the customized executable computer program with the plurality of primers removed, encrypting the customized executable computer program.
12. The non-transitory computer-readable storage medium of claim 10 , wherein customizing the executable program code comprises obfuscating the executable program code.
13. The non-transitory computer-readable storage medium of claim 10 , wherein the customizing the executable program code comprises identifying the plurality of primers based on one or more flags associated with the plurality of primers, the one or more flags indicating portions of the executable computer program that should not be modified.
14. The non-transitory computer-readable storage medium of claim 10 , wherein the plurality of primers each comprise assembly language patterns.
15. The non-transitory computer-readable storage medium of claim 10 , wherein the plurality of primers comprises primers selected from a predetermined set of primer types.
16. The non-transitory computer-readable storage medium of claim 10 , wherein the computer program comprises a source code computer program.
17. The non-transitory computer-readable storage medium of claim 10 , wherein the computer program comprises a binary code computer program.
18. The non-transitory computer-readable storage medium of claim 10 , wherein the customizing is performed by a customization tool, the method further comprising:
providing an indication to the customization tool of one or more locations of the plurality of primers.