System for obfuscating computer code upon disassembly

Abstract

A system for preventing accurate disassembly of computer code. Such code masking, referred to as “obfuscation,” is useful to prevent unwanted parties from making copies of an original author's software, obtaining valuable information from the software for purposes of breaking into a program, stealing secrets, making derivative works, etc. The present invention uses assembly-language instructions so as to confuse the disassembler to produce results that are not an accurate representation of the original assembly code. In one embodiment, a method is provided where an interrupt, or software exception instruction, is used to mask several subsequent instructions. The instruction used can be any instruction that causes the disassembler to assume that one or more subsequent words, or bytes, are associated with the instruction. The method, instead, jumps directly to the bytes assumed associated with the instruction and executes those bytes for a different purpose. A preferred embodiment works with a popular Microsoft “ASM” assembler language and “DASM” disassembler. The instructions used to achieve the obfuscation include “INT” instructions. Using this approach up to 17 bytes of obfuscation can be achieved with five instructions. Each instruction remains obfuscated until executed and returns to an obfuscated state afterwards.

1 . A method for obfuscating computer program instructions upon disassembly, the method comprising: 
 inserting an interrupt instruction for causing a disassembler to not disassemble one or more bytes subsequent to the interrupt instruction; and    inserting a branch instruction to invoke execution of one or more bytes subsequent to the interrupt instruction.    
   
   
       2 . The method of  claim 1  and comprising repeating said inserting an interrupt instruction and said inserting a branch instruction.  
   
   
       3 . The method of  claim 1 , wherein said branch instruction is a jump instruction.  
   
   
       4 . The method of  claim 1 , wherein the steps are performed manually.  
   
   
       5 . The method of  claim 1 , wherein the steps are performed by a software process.  
   
   
       6 . The method of  claim 5 , wherein parameters are supplied to the software process, the method further comprising supplying a parameter to the software process to specify the frequency with which an interrupt instruction is to be inserted in a predetermined program.  
   
   
       7 . The method of  claim 6 , wherein the frequency is specified as a number of instructions of the predetermined program between each insertion of the [obfuscating] interrupt instruction.  
   
   
       8 . A computer-readable media including the following instructions executable by a processor: 
 an interrupt instruction for causing a disassembler to not disassemble one or more bytes subsequent to the interrupt instruction; and    a branch instruction to invoke execution of one or more bytes subsequent to the interrupt instruction.    
   
   
       9 . A computer-readable media including the following obfuscating instructions executable by a processor: 
 JMP $+4    INT 35h    
   
   
       10 . A computer-readable media including the following obfuscating instructions executable by a processor: 
 JMP $+4    INT 35h    INT 20h    
   
   
       11 . An apparatus for obfuscating computer program instructions upon disassembly, the apparatus comprising: 
 an interrupt instruction for causing a disassembler to not disassemble one or more bytes subsequent to the interrupt instruction; and    a branch instruction to invoke execution of one or more bytes subsequent to the interrupt instruction.