# US 11,113,392 B2 · Executable binary code insertion > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,392 B2 - Document ID: US11113392B2 - Status: Granted - Kind: B2 - Application number: 16/539,612 - Filed: 2019-08-13 - Published: 2020-02-20 - Granted: 2021-09-07 - Earliest claimed: 2018-08-14 - Assignees: Runsafe Security, Inc. - Applicants: RunSafe Security, Inc. - Inventors: Erik Raymond Lotspeich; David Nicholas Graham - Web page: https://patentgrep.com/patent/US11113392B2 ## CPC - G06F 21/54: by adding security routines or objects to programs - G06F 21/563: {by source code analysis} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An automated and processor agnostic method is described for modifying one or more executable binary files to insert one or more new software segments to modify the execution of the one or more executable binary files in at least certain circumstances. The modification takes into account the target microprocessor architecture of the one or more executable binary files which can be in the ELF format. In one embodiment, the new software segments are configured to add at least monitoring capabilities to monitor control flow integrity during execution of the one or more executable binary files. ## Claims ### Claim 1 A method for modifying an executable software file, the method comprising: receiving an existing executable software file; receiving a new loadable section for an executable segment of software to be added to the existing executable software file; copying content of a section header string table in the existing executable software file into a new section header string table for which memory has been allocated; adding a new section name for the new loadable section into the new section header string table; writing the new loadable section to an end of the existing executable software file; copying content of a section header table in the existing executable software file into a new section header table and adding a new section entry data for the new loadable section into the new section header table and writing the new section header table into the existing executable software file; copying content of a program header table in the existing executable software file into a new program header table and adding a new segment entry data for the executable segment into the new program header table and writing the new program header table into the existing executable software file; returning a virtual address and a file offset for the executable segment added to the existing executable software file to create a new executable software file. ### Claim 2 (depends on 1) The method of claim 1 wherein the executable segment is to monitor control flow integrity during execution of the new executable software file. ### Claim 3 (depends on 2) The method of claim 2 wherein execution of the new executable software file is tested by comparing execution of the new executable software file to execution of the existing executable software file as it existed before modifications by the method. ### Claim 4 (depends on 2) The method of claim 2 wherein the method is performed automatically by software insertion logic operating on a data processing system that stores the existing executable software file and creates and stores the new loadable section for the executable segment. ### Claim 5 (depends on 4) The method of claim 4 wherein the existing executable software file was compiled for execution on a predefined microprocessor architecture and the method is capable of being performed for a plurality of different microprocessor architectures. ### Claim 6 (depends on 5) The method of claim 5 wherein the virtual address for the executable segment is set to be below a base virtual address for the segments in the existing executable software file prior to modifications by the method. ### Claim 7 (depends on 5) The method of claim 5 wherein the writing of the new loadable section is at a page aligned value at an end of the existing executable software file. ### Claim 8 (depends on 5) The method of claim 5 wherein the new section header table is appended to an end of the existing executing software file. ### Claim 9 (depends on 5) The method of claim 5 wherein the existing executable software file and the new executable software file are in the Executable and Linkable Format (ELF). ### Claim 10 (depends on 1) The method of claim 1 wherein the method further comprises: creating the new loadable section based on specified characteristics of the existing executable software file, the specified characteristics including a target microprocessor architecture, the existing executable software file having been compiled to execute on the target microprocessor architecture; and wherein the method is performed in the sequence recited in claim 1. ### Claim 11 A non-transitory machine readable medium storing executable program which when executed by a data processing system cause the data processing system to perform a method for modifying an executable software file, the method comprising: receiving an existing executable software file; receiving a new loadable section for an executable segment of software to be added to the existing executable software file; copying content of a section header string table in the existing executable software file into a new section header string table for which memory has been allocated; adding a new section name for the new loadable section into the new section header string table; writing the new loadable section to an end of the existing executable software file; copying content of a section header table in the existing executable software file into a new section header table and adding a new section entry data for the new loadable section into the new section header table and writing the new section header table into the existing executable software file; copying content of a program header table in the existing executable software file into a new program header table and adding a new segment entry data for the executable segment into the new program header table and writing the new program header table into the existing executable software file; returning a virtual address and a file offset for the executable segment added to the existing executable software file to create a new executable software file. ### Claim 12 (depends on 11) The medium of claim 11 wherein the executable segment is to monitor control flow integrity during execution of the new executable software file. ### Claim 13 (depends on 12) The medium of claim 12 wherein execution of the new executable software file is tested by comparing execution of the new executable software file to execution of the existing executable software file as it existed before modifications by the method. ### Claim 14 (depends on 12) The medium of claim 12 wherein the method is performed automatically by software insertion logic operating on a data processing system that stores the existing executable software file and creates and stores the new loadable section for the executable segment. ### Claim 15 (depends on 14) The medium of claim 14 wherein the existing executable software file was compiled for execution on a predefined microprocessor architecture and the method is capable of being performed for a plurality of different microprocessor architectures. ### Claim 16 (depends on 15) The medium of claim 15 wherein the virtual address for the executable segment is set to be below a base virtual address for the segments in the existing executable software file prior to modifications by the method. ### Claim 17 (depends on 15) The medium of claim 15 wherein the writing of the new loadable section is at a page aligned value at an end of the existing executable software file. ### Claim 18 (depends on 15) The medium of claim 15 wherein the new section header table is appended to an end of the existing executing software file. ### Claim 19 (depends on 15) The medium of claim 15 wherein the existing executable software file and the new executable software file are in the Executable and Linkable Format (ELF). ### Claim 20 (depends on 11) The medium of claim 11 wherein the method further comprises: creating the new loadable section based on specified characteristics of the existing executable software file, the specified characteristics including a target microprocessor architecture, the existing executable software file having been compiled to execute on the target microprocessor architecture; and wherein the method is performed in the sequence recited in claim 11.