StIns4CS
Amjad Ibrahim, Sebastian Bănescu · 2016
Software protection aims to prevent unauthorized use, analysis, modification and distribution of software. This goal is hard to achieve, especially for a program running on a platform (e.g. physical device) controlled by an adversary also known as man-at-the-end (MATE) attacker. Self-checking is one technique for protecting the integrity of software by having the code check itself. In this paper, we present the design and implementation of a self-checking tool called StIns4CS. Our tool implements self-checking via state inspection by source code transformations of programs written in the C# language. More specifically, StIns4CS augments code by adding runtime checkers to it. We discuss the effectiveness of StIns4CS by implementing attacks targeting our approach, and measuring different aspects of the effectiveness, stealth and cost of the protection. Based on the evaluation we show the trade-off between the efficiency and effectiveness of StIns4CS in protecting software against unauthorized modification. We propose an approach to improve stealth of the code added by StIns4CS and we show further improvements of stealth by combining selfchecking with virtualization obfuscation.