A software protection method based on instruction camouflage

This paper presents a method in which program analysis by a malicious user (attacker) is made difficult by camouflaging (hiding) a large number of instructions contained in the program. In the proposed method, an arbitrary instruction (target) in the program is camouflaged by a different instruction. Using the self-modification mechanism in the program, the original instruction is restored only in a certain period during execution. Even if the attacker attempts an analysis of the range containing the camouflaged instruction, it is impossible for him to correctly understand the original behavior of the program unless he notices the existence of the routine that rewrites the target (restoring routine). In order to make the analysis a success, the range containing the restoring routine must be analyzed, and the attacker is forced to analyze a wider range of the program. The proposed method can easily be automated, and the number of targets can be specified arbitrarily according to the required degree of protection and the acceptable degradation of execution efficiency.