A binary code protection system, named MEPE, was developed. In MEPE, some functions were designed to substitute an original instruction with a functional equivalent sequence of instructions. Theoretical analysis showed that the binary code protected with this method would have diverse appearances. After deformation, the protected codes were fragmented into small snippets which were connected through jump instructions. The destination addresses of these jump instructions were managed by an address table, and the table itself was protected by the technique of dynamic encryption and decryption. Based on the analysis of the impact of instructions in loops on execution time , a tuning method was proposed to balance the effect of protection and time overhead. The experimental results and the analyses showed that the tuning method is effective and the protected codes are much more resistant to static and dynamic analysis.
