Differential Analysis Software Protection

An effective attack method against standard software protection mechanisms is differential analysis, which compares multiple versions of the same protected program to identify their differences. If some of these versions are unprotected, the differencesidentified through differential analysis will reveal the software protection mechanisms used. In this proposal, we have proposed a three-pronged approach to counter software attacks based on differential analysis: (1) A polymorphic whole-program binaryencryption tool ensures that different versions of the same program are syntactically different, (2) A metamorphic code decryption engine generator ensures that the decryption engines embedded in the final protected binaries are themselves different fromone another without relying code encryption, and (3) Insertion of additional anti-reverse-engineering code into the run-time decryption engine ensures that attackers cannot easily apply commercial user-level debuggers to trace the instruction execution andthus uncover the underlying logic of the run-time decryption engine. There are two commercial endeavors that could potentially benefit greatly from the research and development of the binary program transformation technology described in this project. First, digital content management (DRM) systems can greatly benefitfrom the software protection provided by the counter-differential-analysis binary transformation technology, because it can prevent users from tampering and thus bypassing the DRM mechanism. Without proper software protection, DRM is essentially useless asa method to secure monetary revenues for digital content owners/providers.Second, the binary program transformation technology developed in this project will also play an important role in hiding the essential intellectual property underlying software programs from users of those systems of which the programs are a component.Examples of such systems include military/defense systems and any high-priced commercial embedded system products that are built on standard off-the-shelf hardware platforms.