Protection of binary executables using dynamic encryption techniques
AssigneeMagic Shell Software, Inc.
InventorAnthony Samuel Jacobs
Life of this patent
Estimating the term…
Abstract
A facility for securely executing a program is described. The facility stores a number of encoded modules, each including an encoded block and a type field that contains a resource indicator that in turn identifies an encoding resource. The encoding resource has contents specifying details of a process for decoding the encoded block to obtain a working module containing executable code for a portion of the program.
Claims24
A method in a computing system, comprising:
- accessing a set of encrypted modules across which an executable program is encoded, each of the encrypted modules specifying an encoding resource containing information usable to decrypt the encrypted module;
- identifying a first one of the encrypted modules containing an entry point for the program;
- accessing the encoding resource specified for the first encrypted module;
- using contents of the accessed encoding resource specified for the first encrypted module to decrypt the first encrypted module, decryption of the first encrypted module resulting in a first decrypted module corresponding to the first encrypted module being stored in working memory;
- executing the program within the first decrypted module, to a point at which the first decrypted module specifies a call to a first non-local subroutine;
- in response to reaching the point at which the first decrypted module specifies a call to the first non-local subroutine:
- identifying a second one of the encrypted modules containing an entry point for the first non-local subroutine, the second encrypted module being distinct from the first encrypted module;
- using contents of the accessed encoding resource specified for the second encrypted module to decrypt the second encrypted module, decryption of the second encrypted module resulting in a second decrypted module corresponding to the second encrypted module being stored in working memory;
- expunging the first decrypted module from working memory;
- and
- executing the first non-local subroutine within the second decrypted module.
One or more computer memories collectively storing a data structure usable to enable a processor to securely execute a program organized into subroutines, the data structure comprising:
- a first working module in working memory comprising executable code for the program that includes executable code for a first non-local subroutine, a program counter register of the processor identifying a location in the first working module, the first working module having been decoded from a corresponding first encoded module and stored in decoded form in working memory in response to a call to the first non-local subroutine from a second working module that was in working memory at the time of the call, such that working memory contains a decoded version of only a proper subset of all of the executable code of the program.
One or more instances of computer-readable media collectively storing a data structure usable to enable a processor to securely execute a program, the data structure comprising:
- a plurality of encoded modules, each encoded module comprising:
- an encoded block;
- and
- a type field containing a resource indicator identifying an encoding resource, the encoding resource having contents specifying details of a process for decoding the encoded block to obtain a working module comprising executable code for a portion of the program.
One or more instances of computer-readable media collectively having contents configured to cause a computing system to perform a method for managing an in-memory representation of a program, the method comprising:
- executing a first decoded module comprising a first portion of executable code of the program;
- encountering in the execution of the first decoded module a dynamic link stub representing a call to a first non-local subroutine;
- in response to the encountering:
- from the dynamic link stub, identifying an encoded module containing an encoded representation of the first non-local subroutine;
- using contents of an encoding resource specified for the identified encoded module to decode the identified encoded module, decode of the identified encoded module resulting in a second decoded module corresponding to the identified encoded module being stored in working memory;
- and
- executing the first non-local subroutine within the second decoded module.
Dependencies are inferred from the claim text.