System for obfuscating computer code upon disassembly

Abstract

A system for preventing accurate disassembly of computer code. Such code masking, referred to as “obfuscation,” is useful to prevent unwanted parties from making copies of an original author's software, obtaining valuable information from the software for purposes of breaking into a program, stealing secrets, making derivative works, etc. The present invention uses assembly-language instructions so as to confuse the disassembler to produce results that are not an accurate representation of the original assembly code. In one embodiment, a method is provided where an interrupt, or software exception instruction, is used to mask several subsequent instructions. The instruction used can be any instruction that causes the disassembler to assume that one or more subsequent words, or bytes, are associated with the instruction. The method, instead, jumps directly to the bytes assumed associated with the instruction and executes those bytes for a different purpose. A preferred embodiment works with a popular Microsoft “ASM” assembler language and “DASM” disassembler. The instructions used to achieve the obfuscation include “INT” instructions. Using this approach up to 17 bytes of obfuscation can be achieved with five instructions. Each instruction remains obfuscated until executed and returns to an obfuscated state afterwards.

Description

COPYRIGHT NOTICE [0001] A portion of the disclosure recited in the specification contains material which is subject to copyright protection. Specifically, source code instructions are included for a process by which the present invention is practiced in a computer system. The copyright owner has no objection to the facsimile reproduction of the specification as filed in the Patent and Trademark Office. Otherwise all copyright rights are reserved. BACKGROUND OF THE INVENTION [0002] This invention relates in general to computer software and more specifically to a system for preventing accurate disassembly of computer programs. [0003] Computer software manufacturers have a keen interest in protecting their software. Software can be easily copied, in whole or in part, by making digital copies. Other forms of the copying do not require a competitor to copy the actual digital data, but are based on a knowledgeable programmer viewing the instructions within the software to gain information...

AI Technical Summary

Benefits of technology

[0011] The present invention prevents disassembly of computer code. Such prevention includes hiding, masking, or otherwise “obfuscating,” the original code. This helps thwart unwanted parties from making copies of an original author's software, obtaining valuable information from the software for purposes of breaking into the program, stealing secrets, making derivative works, etc. The present invention uses special assembly-language instructions to confuse the disassembler to produce results that are not an accurate representation of the original assembly code. In one embodiment, a method is provided where an interrupt (typically a software interrupt) is used to mask some of the subsequent instructions. The instruction used can be any instruction that causes the disassembler to assume that one or more words subsequent to the instruction, are associated with the instruction. The method, instead, jumps directly to the bytes assumed associated with the instruction and executes those bytes to achieve the original functionality of the program.

Problems solved by technology

One barrier to copying computer software is that many forms of software are distributed in a format that is not easily decipherable, or readable, by a human.

However, tools exist to decompile, or disassemble, these unreadable versions of source code.

Images