Method and apparatus for dynamic executable verification
AssigneeARRIS Enterprises LLC
InventorLex Aaron Anderson
Life of this patent
Estimating the term…
Abstract
A method and apparatus for Dynamic Executable Verification (DEV) is disclosed that includes a random prefix of functions of a binary application, a check function for at least a subset of the functions and a jump table for at least a subset of the functions. DEV provides low-impact dynamic integrity protection to applications that is compatible with standard code signing and verification methods, and ensures that software cannot be tampered with either statically or dynamically without detection.
Claims16
A method of generating a dynamically verifiable application executable having a plurality of functions, comprising:
- at build time:
- prepending a random prefix to at least a subset of the plurality of functions ƒ of a binary of the application;
- generating a check function for each function of the at least a subset of the plurality of functions;
- injecting each of the generated check functions into random locations in the binary of the application;
- generating a jump table J, the jump table J having, for each function in the subset of the plurality of functions:
- a mapping between the respective function and the generated check function;
- wherein the mapping between the respective function and generated check function is associated with a identifier o and is randomly injected into the jump table J;
- and
- injecting a call to the jump table having the identifier into a bootstrap of the binary of the application to generate a protected binary of the application;
- at link time:
- linking the protected binary of the application to generate the application executable;
- and
- at activation time:
- generating hash table data using the bootstrap.
A method of generating a dynamically verifiable application executable having a plurality of functions, comprising:
- at build time:
- prepending a random prefix to at least a subset of the plurality of functions ƒ of a binary of the application;
- generating a check function for each function of the at least a subset of the plurality of functions;
- injecting each of the generated check functions into random locations in the binary of the application;
- generating a jump table J, the jump table J having, for each function in the subset of the plurality of functions:
- a mapping between the respective function and the generated check function;
- wherein the mapping between the respective function and generated check function is associated with a identifier o and is randomly injected into the jump table J;
- and
- injecting a call to the jump table having the identifier into a bootstrap of the binary of the application to generate a protected binary of the application,
- wherein generating a check function for at least one function of the at least a subset of the plurality of functions comprises automatically generating a check function for each function of a selected group of the at least a subset of the plurality of functions, and wherein each of the check functions are randomly selected.
An apparatus for generating a dynamically verifiable application executable having a plurality of functions, comprising:
- a processor;
- a memory, communicatively coupled to the processor, the memory storing processor instructions including processor instructions for, at build time:
- prepending a random prefix to at least a subset of the plurality of functions ƒ of a binary of the application;
- generating a check function for at least one function of the at least a subset of the plurality of functions;
- injecting each of the generated check functions into random locations in the binary of the application;
- generating a jump table J, the jump table J having, for each function in the subset of the plurality of functions:
- a mapping between the respective function and the generated check function;
- wherein the mapping between the respective function and generated check function is associated with a random opaque identifier o and is randomly injected into the jump table J;
- and
- injecting a call to the jump table having the identifier into a bootstrap of the binary of the application to generate a protected binary of the application,
- wherein the application executable is activated by generating hash table data using the bootstrap.
Dependencies are inferred from the claim text.