Software Protection with Code Mobility

Abstract

The analysis of binary code is a common step of Man-At-The-End attacks to identify code sections crucial to implement attacks, such as identifying private key hidden in the code, identifying sensitive algorithms or tamper with the code to disable protections (e.g. license checks or DRM) embedded in binary code, or use the software in an unauthorized manner. Code Mobility can be used to thwart code analysis and debugging by removing parts of the code from the deployed software program and installing it at runtime by downloading binary code blocks from a trusted server. The proposed architecture of the code mobility protection downloads mobile code blocks, which are allocated dynamically at addresses determined at run-time; control transfers into and out of mobile code blocks are rewritten using the Diablo binaryrewriter tool.

Code Renewability for Native Software Protection

“…Figure 1 visualizes the ASPIRE renewability architecture. It is based on code and data mobility, which builds on the existing concept of code mobility [15]. From the binary file of a client app or library that needs to be protected, parts of the statically allocated code and data sections are extracted.…”

“…This includes replacing the stub's address with the block's address in the GMRT, and then continuing execution at the entry of the block. All transfers out of a block are transformed into offset-independent code by adding a level of indirection [15].…”

“…Figure 2 depicts the tool flow that integrates the renewability framework with protections. Full black arrows denote the compiler and protection tool flow of code and data that includes basic code mobility [15] but without renewability. Dashed black arrows denote the generation of renewable code generators.…”

A meta-model for software protections and reverse engineering attacks

“…The ACTC's protections aim at defending against reverse-engineering, tampering, and cloning. They include code and data obfuscations [13], white-box cryptography (as also discussed in Section 4.2.8) [36], code mobility [41], code diversity, code guards, code renewability, remote attestation and migration of sensitive code to secure servers [42], use of custom instruction sets interpreted by virtual machines [37] (as also discussed in Section 4.2.8), anti-debugging by means of self-debuggers [27], and more.…”

Understanding the behaviour of hackers while performing attack tasks in a professional setting and in a public challenge

“…Ch 1: In this challenge, an array is constructed by a block of code that is protected with an anti-debugging protection that prevents an attacker from attaching his own debugger to study the internal operation of the program [1]. Next, code mobility [7] is used to protect the XORing of this array with mobile data (i.e., data that is not present in the static program binary, but is downloaded from a secure server at run time). Mobile code also contains the invocation to .…”