Comparing it to shuffling cards might be a better, or at least friendlier analogy than the DARPA researchers jigsaw puzzle. :)
The Themida-based GOTD wrapper keeps you from getting your hands on the enclosed setup file, but it doesn't alter that file, or the installed app AFAIK. My understanding is that it does 2 things -- it's an encrypted container, like a password protected .zip file, & when it's run it decodes & runs its contents in RAM in a way that cannot be easily captured. I could be wrong on the way it functions re: RAM, but I'd think anything with any focus on security would protect anything it stored there.
Running processes in RAM have been a recent issue with a couple of mobile OS vulnerabilities I think. Data stored in RAM has been the subject of security research with encryption software like Truecrypt, and with the POS [Point Of Sale] card readers that retailers use -- in both cases there were vulnerabilities to so-called memory scraping.
I Think some of the protections involve random memory addresses, so there's no one place in RAM to look for the code or data, while others encrypt before it's stored in RAM, & others look to protected sandboxes etc. Microsoft's work compressing data stored in RAM might provide some interesting tools or possibilities there perhaps?
"Perhaps Intel/AMD will built this de-encryptor into a new generation of processors."
I think this is an area where Intel has spent tons of money on research, & why they bought McAfee. I *think* some of the results are in the new Skylake CPUs.
arstechnica.com/information-technology/2015/08/the-many-tricks-intel-skylake-uses-to-go-faster-and-use-less-power/
Some instructions have been made faster, with Intel claiming that the AES acceleration instructions have increased encryption performance by up to 33 percent (in CBC mode) or 17 percent (in GCM mode).
The threatpost article & the original it referenced both quoted the researchers as saying they've got a long way to go before they make it efficient. And if they expect wide adoption they'll have to do better than something like the open source UPX compacter -- I think it's relatively small bit of inefficiency is one of the reasons cited that more people don't use it.
While the DARPA researchers talk about using new way to encrypt program code, the program file(s) itself would still be encrypted, same as the GOTD wrapper & a lot of malware, so the net effect to anti-virus software would be the same as now, with encrypted executables -- code that it cannot examine doing things that it cannot examine. And of course if the results of the DARPA work are open source, the bad guys/gals will use it to worsen the nightmares of the security software folks.
"Nice subject for a bachelor thesis, followed by a MSc graduate project and finalised by a PhD. Perhaps a post-doc? And after that a well-paid job at Intel. "
I'd expect the DARPA funded professors will use that to attract the best & brightest, who will do the bulk of the work under the auspices of the professors, & said professors will reap the biggest rewards. The professors also might do related research developing patents & forming their own companies to exploit them, but that's the tip of the iceberg -- research is like a whole separate world. Those students that make breakthroughs will use that to launch their own careers, while the ones that don't will likely wind up knocking on Intel's door just as you've said.
