US 2021/0200862 A1 · SYSTEMS AND METHODS FOR RELIABLY INJECTING CONTROL FLOW INTEGRITY INTO BINARIES BY TOKENIZING RETURN ADDRESSES

Abstract

Systems and methods of modifying a program binary by injecting code into a function of a program binary that tokenizes the return address of the function. The tokenization of the return address improves the robustness of the program binary against cyberattacks. For example, an attacker's attempt to hijack program flow before a function return will fail since any return address modified by the adversary will be tokenized (e.g., using a binary operation such as an XOR) resulting in an unusable address that will cause the system to crash. One advantage of the improved CFI consumes less average overhead and does not require all of the complications of the conventional CFI systems. In some embodiments, the tokenization includes applying a binary operation on a randomly-generated token and the return address. The token can be generated at transform time, load time, or run time.

Claims20

Dependent claims

A method of modifying a program binary by injecting code into a function of a program binary for defending against cybersecurity attacks on a stack register included as part of a random access memory (RAM) configured for storing local variables of a function used by the program binary, the method comprising:

generating a random token;
creating a list of functions in the program binary;
adding a new data section in the program binary;
inserting the token in the new data section;
at entry of a function in the list of functions:
(a) saving previous states of one or more registers on the stack register;
(b) retrieving the token from the new data section;
(c) retrieving a return address of the function saved on the stack register;
(d) generating a tokenized return address by applying a binary operation on the return address and the token;
(e) overwriting the return address saved on the stack register with the tokenized return address;
(f) restoring the one or more registers to the previous states;
at exit of the function:
repeating steps (a) through (f).

10 more elements

A non-transitory computer-readable storage medium having stored thereon instructions for modifying a program binary by injecting code into a function of a program binary for defending against cybersecurity attacks on a stack register included as part of a random access memory (RAM) configured for storing local variables of a function used by the program binary, wherein the instructions when executed by a processor of an electronic device cause the processor to:

generate a random token;
create a list of functions in the program binary;
add a new data section in the program binary;
insert the token in the new data section;
at entry of a function in the list of functions:
(a) save previous states of one or more registers on the stack register;
(b) retrieve the token from the new data section;
(c) retrieve a return address of the function saved on the stack register;
(d) generate a tokenized return address by applying a binary operation on the return address and the token;
(e) overwrite the return address saved on the stack register with the tokenized return address;
(f) restore the one or more registers to the previous states;
at exit of the function:
repeat steps (a) through (f).

10 more elements

Dependencies are inferred from the claim text.

Systems and methods for reliably injecting control flow integrity into binaries by tokenizing return addresses

Life of this patent

Systems and methods for reliably injecting control flow integrity into binaries by tokenizing return addresses

Life of this patent

Abstract

Claims20