Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
  • G06F21/12—Protecting executable software
  • G06F21/14—Protecting executable software against software analysis or reverse engineering, e.g. by obfuscation

Definitions

• the invention is in the field of data protection and computer programs and more specifically relates to a method of obscuring a computer program to prevent disassembly thereof, i.e. rebuilding the source code from the executable code, and / or the modification (patch) by unauthorized persons.
• the invention also relates to a computer program recorded on a medium and comprising instruction lines which, when executed by a computer, make it possible to obfuscate said program.
• the invention also relates to a use of the method according to the invention for obscuring a computer program recorded on a medium and intended to perform the functions of a flight simulator when it is run on a computer.
• the obscuration techniques of known computer programs are essentially based on the use of utilities called "packers" whose function is to compress the executable program (.exe, .dll, .ocx, etc.) and to encrypt it simultaneously.
• the packers are made of two parts:
• Packers are more suitable for copy protection than darkening programs.
• the packers introduce transformations on the program to be protected which complicates the execution.
• An object of the invention is to achieve a simple and effective obfuscation of a program without complicating the execution.
• Another object of the invention is to hide the transformations of a program.
• the method according to the invention further comprises a step of assembling the new program line to obtain the opcodes and to use the opcodes obtained as operands of the operation providing the numerical value V.
• the method according to the invention comprises a step of replacing the value of said digital variable V by the result of the operation defined in step b)
• the digital coding of the instruction using the digital value V is replaced by the memory address pointed by the operation whose execution provides said digital value V.
• steps a), b) and c) of the method according to the invention are repeated recursively.
• the invention applies to the obfuscation of a computer program recorded on a medium and intended to perform, when executed by a computer, simulation functions, security data processing, or industrial process management.
• the method according to the invention is applicable to all computer programs comprising a plurality of lines of instructions written in a source language and intended to be translated by a compiler into a target language.
• the source language may be for example a high level programming language of abstraction and the target language is an assembly language or machine language called object code.
• the method according to the invention is used to obscure a computer program representing a flight simulator.
• the attached figure illustrates the essential steps of the method according to the invention.
• a particular line of the source code is selected.
• a line is selected containing an instruction or an essential data item of the program that is to be masked.
• step 4 it is verified that the selected line can be assembled independently of the other lines of the source code. If yes, we perform assembly of the selected line and replace it with these opcodes.
• step 8 a numerical variable V or an instruction with a numerical value V is chosen.
• step 10 an operation is defined whose execution provides said digital value V and at least one line of the program is substituted for hide by a new program line performing said operation.
• step 12 the assembly code representing the operation defined in step 10 is generated.
• step 14 if V is a numerical variable, the initialization of said variable is replaced by the expression that makes it possible to obtain it.
• step 16 if V is a constant numerical value, the assembly code representing the operation defined in step 10 is placed before the instruction chosen in step 8 and the numerical value is replaced. V by the register or the memory address containing the result of the operation defined in step 10.
• the first code shows that the numeric value 0x12 is replaced by a calculation using the "non-numeric" element located at the address 0x2, in this case an instruction opcode 0x89 to which it removes 0x77 to find the value 0x12.
• the original code is: 00000002 89ca mov edx, ecx
• the code modified by the method according to the invention is as follows:
• the original code is: 00000004 3IcO xor eax, eax 00000006 31db xor ebx, ebx
• 00000009 8b3d00200000 edi mov, [0x2000] 0000000f 2b3d04000000 sub edi, [0x4] 00000015 83ffl2 edi cmp, 0x12 00002000 75f353ec global value 0xec53f37.

Applications Claiming Priority (2)

Publications (1)

Family

ID=40852490

Family Applications (1)

Country Status (5)

Families Citing this family (2)

Citations (1)

Family Cites Families (13)

• 2009
  • 2009-02-24 FR FR0951161A patent/FR2942558B1/fr not_active Expired - Fee Related
• 2010
  • 2010-02-23 CA CA2752339A patent/CA2752339C/fr not_active Expired - Fee Related
  • 2010-02-23 US US13/201,503 patent/US9239913B2/en not_active Expired - Fee Related
  • 2010-02-23 EP EP10709452A patent/EP2401693A1/de not_active Withdrawn
  • 2010-02-23 WO PCT/EP2010/052276 patent/WO2010097382A1/fr active Application Filing

Patent Citations (1)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events