Enhancing Software Tamper-Resistance via Stealthy Address Computations

A great deal of software is distributed in the form of executable code. The ability to reverse engineer such executables can create opportunities for theft of intellectual property via software piracy, as well as security breaches by allowing attackers to discover vulnerabilities in an application [9]. Techniques such as watermarking and fingerprinting have been developed to discourage piracy [4, 12], however, if no protective measures are taken, an attacker may be able to remove and/or destroy watermarks and fingerprints with relative ease once they have been identified. For this reason, methods such as source code obfuscation [4, 11, 3, 15], code encryption [1, 13] and self verifying code[1, 7] have been developed to help achieve some measure of tamper-resistance. It is, of course, necessary for an attacker to gain a reliable disassembly of some portion of executable code before any intelligent tampering can take place. In fact, even a reliable disassembly in the absence of some sort of control flow graph is not sufficient for serious tampering[15]. Coupled with other methods [9] we propose one method of obfuscating address computations in which the targets of control transfers are made difficult to determine statically. We describe this method in Section 2. Assuming an attacker is able to gain a reliable disassembly of a binary, it is quite possible for a malicious host to compromise any and all watermarks and/or fingerprints such that they no longer serve their intended purpose [5]. Code verification schemes that employ techniques such as check-sums have been introduced to “tamper-proof” code [2]. Such schemes must, by definition, examine the code in an executable’s text section. Done in a straightforward manner, the check-sum code will contain load instructions that reference addresses that are clearly in the text section, allowing attackers to easily identify the check-sum code and potentially disable them ([1, 2] propose ways to raise the difficulty involved in doing so). To counter such attacks we propose one method by which address computations involving text section references can be made less obvious. We discuss this in Section 3.