Software Watermarking using Return-Oriented Programming

Abstract

We propose a novel dynamic software watermarking design based on Return-Oriented Programming (ROP). Our design formats watermarking code into well-crafted data arrangements that look like normal data but could be triggered to execute. Once triggered, the pre-constructed ROP execution will recover the hidden watermark message. The proposed ROP-based watermarking technique is more stealthy and resilient over existing techniques since the watermarking code is allocated dynamically into data region and therefore out of reach of attacks based on code analysis. Evaluations show that our design not only achieves satisfying stealth and resilience, but also causes significantly lower overhead to the watermarked program.

Software Watermarking based on Return-Oriented Programming for Computer Security

“…The main idea of the proposed work taken from the recent proposed dynamic software watermark in [4] they use ROP and turn it into a good use and created new software watermark. The proposed software watermark collect the watermark codes from the existing code, in the data region the ROP convert codes into ROP gadgets and build them; these codes lead to unexpected execution path.…”

“…Therefore, it is a fact that the ROP is the most famous technique used in malicious uses. And the latest research proved that the ROP could be used not only for malicious uses but also in benign uses like software watermark [4].…”

“…The first three steps of building ROP program responsible for embedding watermark into the program and the final step responsible for extracting the hidden watermark. In the proposed work, the watermark embed is a simple watermark and the idea of the watermark taken from [4], the proposed watermark message is "007" and stored in string S, not as integer number "007" but stored as ASCII code of the integer number "007" which is "484855". To embed watermark, three important gadgets have been selected to control the watermark embedding and building the proposed ROP payload around it; the following points describe the watermark embed process (see Figure 2):  First the initiation stub in charge for two functions: first, save the current stack pointer address to return to after extract watermark.…”

“…It is a fact the using simple block of comparisons such as if and else statement to compare between the entered input and constant secret input in the program is the simplest solution. However this solution could attract attacker attention when analyzing the program [4]. Thus, building a complex trigger function is harder to discover or analyzes by program analysis.…”

“…One of the more resilient and stealthy over existing techniques in dynamic watermarks is software watermarking using ROP [4] which designs watermarking code to look like normal data and triggered to execute. After triggered, the hidden watermark message recovers by the pre-constructed ROP execution.…”