The Superdiversifier: Peephole Individualization for Software Protection

We present a new approach to individualize programs at the
machine- and byte-code levels. Our superdiversification methodology is
based on the compiler technique of superoptimization, which performs
a brute-force search over all possible short instruction sequences to find
minimum-size implementations of desired functions. Superdiversification
also searches for equivalent code sequences, but we guide the search by
restricting the allowed instructions and operands to control the types of
generated code. Our goal is not necessarily the shortest or most optimal
code sequence, but an individualized sequence identified by a secret key
or other means, as determined by user-specified criteria. Also, our search
is not limited to commodity instruction sets, but can work over arbitrary
byte-codes designed for software randomization and protection. Applications
include patch obfuscation to complicate reverse engineering and
exploit creation, as well as binary diversification to frustrate malicious
code tampering. We believe that this approach can serve as a useful
element of a comprehensive software-protection system.