“Less is more” is a popular oxymoron. In software protection, most ISVs might express this commonplace statement as "I would like to achieve maximum protection with minimal effort". But is this possible at all? Can you really expect the strongest encryption method with just a minimum investment in your own resources? Wibu-Systems has solved this paradox with CodeMeter Protection Suite. Guided tools that encrypt a compiled application or a library in an automatic and secure way are made available for all common platforms. AxProtector, AxProtector .NET, and AxProtector Java are your reliable companions for this rapid and straightforward process. For the optimal protection of your software application, the code should be split into individual parts and dynamically reassembled at runtime. AxProtector .NET and AxProtector Java take care of this operation in a fully automated fashion for you. But what about native applications and libraries that are protected with AxProtector? In this case, IxProtector, integrated with AxProtector, takes over this procedure for you. You can choose between semi-automatic and fully manual controls. This is where Translocated Execution enters the scene and inserts automatic decryption routines into your application. In addition to the implementation of simple automatisms, Translocated Execution also moves executable code into memory. Functions are temporally superimposed, so that finding a dedicated function in a memory dump becomes a matter of pure luck for a would-be attacker and a systematic memory dump of all functions becomes practically impossible. In short, Translocated Execution offers two main advantages: The automatic decryption and execution of the code reduces your manual efforts to a minimum. Moving code into memory increases security standards against memory dumps. Get to know the theory behind Translocated Execution, see the necessary steps, and learn about the available optimization options. A combination with additional security techniques like traps, which are also an essential part of Blurry Box cryptography, is also possible at any time. This presentation is covering some of the core technology concepts and several innovative features: An overview of CodeMeter Protection Suite Basic principles underpinning AxProtector Basic principles underpinning IxProtector Translocated Execution Security considerations The presentation is aimed to prove how extremely secure software protection mechanisms can be implemented with little effort. Translocated Execution will raise the security bar for hackers, as the wizard for AxProtector and IxProtector will automatically disassemble your application into many small parts that are dynamically re-assembled at runtime. A minimalist approach to software protection made possible by CodeMeter Protection Suite. Watch the webinar: https://youtu.be/pPOAdyahHXU

1. The Effort-Performance Relationship
in Software Protection
Alvaro Forero | Security Expert
alvaro.forero@wibu.com
Ruediger Kuegler | Security Expert
ruediger.kuegler@wibu.com
Virtual CodeMoving with
Translocated Execution
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 1

2. Agenda
 Overview of CodeMeter Protection Suite
 AxProtector
 IxProtector
 Translocated Execution
 Live Demo
 Summary – Security
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 2

3. CodeMeter
Protection Suite
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 3

4. CodeMeter Protection Suite
CodeMeter Protection Suite
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection
Automatic Protection
(IP Protection)
Anti-Debug Methods
Used
CodeMeter Variant
Individual
Function Encryption
Integrity Protection
(Tamper Protection)
Authenticity of Software
(Secure Loader / Authenticity)
Java SE
Java EE
Embedded
Operating System
.NETPC (Windows,
Linux, macOS)
CodeMeter
Runtime
CodeMeter
Runtime
CodeMeter
Runtime
CodeMeter
Embedded
CodeMeter
Embedded
IxProtector
AxProtector
AxProtector .NET
AxProtector Java
AxProtector CmE
ExProtector
4

5. AxProtector
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 5

6. Protected Application
AxProtector
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 6
Compiled Application
Data Section
Resource Section
Code Section
AxProtector
Header
Data Section
Resource Section
Code Section
Header
Encrypted
Code Section
Encrypted
Data Section
Encrypted
Resource Section
AxEngine
(Security Engine)

7. Compiled Application
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 7

8. Protected Application
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 8

9. Security Options
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 9
 Resource Encryption
 Code modifications
 Static
 Dynamic
 Debugger Checks
 Basic
 Advanced
 Generic
 Locking of licenses

10. No Inter-Section Calls (Option –a)
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 10
Protected ApplicationCompiled Application
Header
AxProtector
Header
Data Section
Resource Section
Code SectionCode Section
Data Section
Resource Section
Code SectionEncrypted
Code Section
Encrypted
Data Section
Encrypted
Resource Section
AxEngine
(Security Engine)

11. IxProtector
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 11

12. Protected Application
AxEngine
(Security Engine)
Compiled Application
IxProtector
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 12
IxProtector
Header
Data Section
Resource Section
Code Section
Function Function
Header
Code Section
Data Section
Resource Section
Function Function
Encrypted
Function
Encrypted
Function

13. Encrypted Single Function
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 13

14. Encrypted Code Makes No Sense
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 14
Unencrypted Code Encrypted (nonsense) Code

15. Protected Application
AxEngine
(Security Engine)
Compiled Application
AxProtector and IxProtector
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 15
AxProtector
IxProtector
Header
Data Section
Resource Section
Code Section
Function Function
Header
Code Section
Data Section
Resource Section
Function Function
Encrypted
Function
Encrypted
Function
Encrypted
Data Section
Encrypted
Resource Section
Encrypted
Code Section
Encrypted
Function
Encrypted
Function

16. IxProtector (During Runtime - Standard)
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 16
 Start of the application
 …
 Calling WupiDecryptCodeId(n)
 Decrypts function n in place
 Executing function n
 Calling WupiEncryptCodeId(n)
 Encrypts function n in place
 …
Protected Application
Header
Code Section
Data Section
Function Function
Encrypted
Function
Encrypted
Function
Encrypted
Data Section
Encrypted
Code Section
Encrypted
Function
Encrypted
Function
Encrypted
Resource Section
AxEngine
(Security Engine)

17. Translocated Execution
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 17

18. Protected ApplicationCompiled Application
IxProtector with Translocated Execution
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 18
IxProtector
Header Header
Code Section
Function Function
Data Section
Resource Section
Code Section
Data Section
Resource Section
Function FunctionStub
Enc.
Function
Stub
Enc.
Function
Encrypted Functions
AxEngine
(Security Engine)

19. Protected ApplicationCompiled Application
AxProtector and IxProtector with Translocated Execution
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 19
AxProtector
IxProtector
Header
Data Section
Code Section
Function Function
Header
Encrypted Functions
Resource Section
Code Section
Data Section
Resource Section
Function FunctionStub
Enc.
Function
Stub
Enc.
Function
Encrypted Code Section
Stub
Enc.
Function
Stub
Enc.
Function
Enc. Resource Section
Encrypted Data Section
AxEngine
(Security Engine)

20. IxProtector (During Runtime – With Translocated Execution)
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 20
 Start of the application
 …
 Executing function n
 Decrypts function n on heap
 Jumps to function n
 Removes (overrides) function n from
heap
 …
 Next function at the same location Protected Application
AxEngine
(Security Engine)
Header
Encrypted Functions
Code Section
Data Section
Stub
Enc.
Function
Stub
Enc.
Function
Encrypted Code Section
Stub
Enc.
Function
Stub
Enc.
Function
Encrypted Data Section
Heap
FunctionFunction
Enc. Resource Section

21. Available Options
 Automatic (1)
 Decryption, Execution, Deletion
 Manual (2)
 WupiDecryptCodeId, Call, WupiEncryptCodeId
 Automatically with cache (5)
 Decryption, Execution, Caching
 Deletion after x seconds
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 21

22. Demo
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 22

23. Summary – Security
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 23

24. Security
 AxProtector decrypts the complete executable when starting the
application
 Anti-Dumping, Modifications and resource encryption
 Prevention of inter-section calls
 IxProtector keeps many single functions encrypted in memory
 Decryption during runtime on demand
 Translocated Execution makes it even harder to detect these functions
during runtime
 Dynamic and automatic decryption during runtime
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 24

25. Germany: +49-721-931720
USA: +1-425-7756900
China: +86-21-55661790
http://www.wibu.com
info@wibu.com
Thank you for your active participation!
06.09.2017 © WIBU-SYSTEMS AG 2017 - The Effort-Performance Relationship in Software Protection 25