# US 10,310,991 B2 · Timely address space randomization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,310,991 B2 - Document ID: US10310991B2 - Status: Granted - Kind: B2 - Application number: 15/234,028 - Filed: 2016-08-11 - Published: 2018-02-15 - Granted: 2019-06-04 - Earliest claimed: 2016-08-11 - Assignees: Massachusetts Institute of Technology - Applicants: Massachusetts Institute of Technology - Inventors: Hamed Okhravi; Thomas R. Hobson; David O. Bigelow; Robert Rudd; William W. Streilein - Web page: https://patentgrep.com/patent/US10310991B2 ## CPC - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 12/023: {Free address space management} - G06F 16/245: Query processing - G06F 21/125: {by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/54: by adding security routines or objects to programs - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for timely address space randomize includes loading a code region from a program binary to a first location within the address space, detecting, during execution of the program, an output-input call pair from the program and, in response to detecting the output-input call pair from the program: selecting a second location within the address space to move the code region to, determining memory locations of one or more references to the code region, updating the values of the references in memory based on the second location and using annotation information within the program binary, and moving the code region to the second location within the address space. ## Claims ### Claim 1 In a system executing a program within a memory address space, a method comprising: loading a code region from a program binary to a first location within the address space; detecting, during execution of the program, one or more output calls immediately followed by an input call (an “output-input call pair”) from the program; and in response to detecting the output-input call pair from the program and before processing the input call on behalf of the program: selecting a second location within the address space to move the code region to; determining memory locations of one or more references to the code region; updating the values of the references in memory based on the second location and using annotation information within the program binary; and moving the code region to the second location within the address space; wherein an output call comprises a function call, made by the program, that discloses contents of memory of the program to a user of the program, and wherein an input call comprises a function call, made by the program, that enables a user of the program to affect internal logic of the program. ### Claim 2 (depends on 1) The method of claim 1 wherein selecting a second location within the address space comprises selecting a random location within the address space. ### Claim 3 (depends on 1) The method of claim 1 wherein detecting an output-input call pair from the program is performed in kernel space and wherein updating the values of the references in memory based on the second location and using annotation information within the program binary is performed in userspace. ### Claim 4 (depends on 3) The method of claim 3 further comprising, in response to detecting the output-input call pair: injecting code into the address space, the injected code operable to update the values of the references in memory based on the second location and using annotation information within the program binary. ### Claim 5 (depends on 1) The method of claim 1 wherein detecting an output-input call pair from the program comprises: detecting an output call from a first process within a process group; and detecting an input call from a second process with the process group. ### Claim 6 (depends on 1) The method of claim 1 wherein moving the code region to the second location within the address space comprises updating a virtual memory page table. ### Claim 7 (depends on 1) The method of claim 1 further comprising, in response to detecting the output-input call pair from the program: pausing the program; making a copy of a register set associated with the program; updating one or more references to the code region within the copy of the register set; restoring the register set associated with the program using the updated copy of the register set; and resuming the program. ### Claim 8 (depends on 1) The method of claim 1 wherein updating the values of the references in memory comprises updating the value of global variables, stack-based variables, and dynamically allocated variables. ### Claim 9 (depends on 8) The method of claim 8 wherein updating the value of global variables and stack-based variables comprises using tagged unions to determine the current data type of global variables and stacked-based variables. ### Claim 10 (depends on 8) The method of claim 8 further comprising: tracking the location of one or more dynamically allocated references to the code region, wherein updating the values of the references in memory comprises using the tracked location of the one or more dynamically allocated references. ### Claim 11 (depends on 1) The method of claim 1 further comprising, in response to detecting the output-input call pair from the program: updating one or more references to signal handlers defined within the code region. ### Claim 12 In a system compiling a program and executing the program within a memory address space, a method comprising: analyzing source code of the program to identify code references; compiling the source code to generate an annotated binary having a code region; loading the code region into memory at a first location; detecting, during execution of the annotated binary, one or more output calls immediately followed by an input call (an “output-input call pair”); in response to detecting the output-input call pair and before processing the input call on behalf of the program: selecting a second location in memory to move the code region to; determining the location of the code references in memory; updating the value of the code references in memory based on the second location using annotation information within the annotated binary; and moving the code region from the first memory location to the second memory location; wherein an output call comprises a function call, made by the program, that discloses contents of memory of the program to a user of the program, and wherein an input call comprises a function call, made by the program, that enables a user of the program to affect internal logic of the program. ### Claim 13 (depends on 12) The method of claim 12 wherein compiling the source code to generate an annotated binary having a code region comprises generating an annotated binary having information about the location of global code reference variables and stack-based code references. ### Claim 14 (depends on 12) The method of claim 12 wherein analyzing source code to identify code references comprises identifying global code references, stack-based code references, and dynamically allocated code references. ### Claim 15 (depends on 14) The method of claim 14 wherein identifying dynamically allocated code references comprises identifying dynamic allocations statements using the sizeof( ) operator on a data type associated with code references. ### Claim 16 (depends on 12) The method of claim 12 wherein compiling the source code to generate an annotated binary comprises generating Position Independent Executable/Code (PIE/PIC). ### Claim 17 (depends on 12) The method of claim 12 wherein compiling the source code to generate an annotated binary comprises treating references to objects within a program data region as externally visible global references residing in different compilation units. ### Claim 18 (depends on 17) The method of claim 17 wherein the annotated binary includes a Global Offset Table (GOT) through which the references to objects within a program data region are routed. ### Claim 19 (depends on 12) The method of claim 12 wherein compiling the source code to generate an annotated binary comprises generating a tagged union wherever a union with a code reference is encountered in the source code. ### Claim 20 A system comprising: one or more processors; a volatile memory; and a non-volatile memory storing computer program code that when executed on the processor causes execution across the one or more processors of a process operable to perform the operations of: load a code region from a program binary to a first location within the address space; detect, during execution of the program, one or more output calls immediately followed by an input call (an “output-input call pair”) from the program; in response to detecting the output-input call pair from the program and before processing the input call on behalf of the program: select a second location within the address space to move the code region to; determine memory locations of one or more references to the code region; update the values of the references in memory based on the second location and using annotation information within the program binary; and move the code region to the second location within the address space; wherein an output call comprises a function call, made by the program, that could disclose contents of memory of the program to a user of the program, and wherein an input call comprises a function call, made by the program, that enables a user of the program to affect internal logic of the program.