System and method for annotation driven integrity verification

A computer-implemented method comprising:

• receiving via a processor source code having a verification call comprising one or more groups to verify, a verification strength parameter, corruption instructions, and a checksum module, wherein the verification strength parameter defines at least one of a maximum processor time spent on verification or a number of verification calls to insert;
• generating a binary from the source code, the generating comprising:
• replacing the verification call with one or more equivalent verification calls distributed over each call path leading to the verification call, wherein at least one verification call is configured to perform at least one of silently corrupting the binary or returning an error when the verification code does not match a reference checksum;
• replacing each equivalent verification call with a checksum function selected from a pool of checksum functions;
• inserting verification checksum placeholders comprising junk data representing a recognizable pattern, wherein each verification checksum placeholder is associated with a verification chunk;
• replacing the junk data in each verification checksum placeholder in the binary with reference checksums, wherein a placeholder is identified through the recognizable pattern, whereby the replacing eliminates the recognizable pattern.

A system for generating a computer executable binary, the system comprising:

• a processor;
• a module configured to control the processor to generate a binary from source code, the generating comprising:
• a module configured to control the processor to insert a plurality of verification calls configured to verify at least one function, wherein at least one verification call is inserted on each call path leading to the at least one function, and further wherein at least one verification call is configured to silently corrupt the binary or return an error when verification fails, wherein each verification call of the plurality of verification calls comprises a verification group, a verification strength, corruption data, and a checksum function, and further wherein the verification strength defines at least one of a maximum processor time spent on verification or a number of verification calls to insert;
• a module configured to control the processor to distribute, across the binary, placeholders associated with the plurality of verification calls, wherein a placeholder comprises junk data representing a recognizable pattern
• a module configured to control the processor to replace the junk data in each placeholder in the binary with reference checksums, wherein a placeholder is identified through the recognizable pattern, whereby the replacing eliminates the recognizable pattern.

A non-transitory computer-readable storage medium storing a set of program instructions executable on a data processing device, the instructions causing the data processing device to perform the steps:

• receiving source code, the source code including at least one annotated function;
• generating a binary from the source code, the generating comprising:
• inserting a plurality of verification calls configured to verify the at least one annotated function, wherein at least one verification call is inserted on each call path leading to the at least one annotated function, and further wherein at least one verification call is configured to perform at least one of silently corrupting the binary or returning an error when the verification code does not match a reference checksum, and wherein each verification call comprises a verification group, a verification strength, corruption data, and a checksum module, and further wherein the verification strength defines at least one of a maximum processor time spent on verification or a number of verification calls to insert;
• inserting placeholders associated with the plurality of verification calls, wherein a placeholder comprises junk data representing a recognizable pattern;
• and
• replacing the junk data in each placeholder in the binary with verification data, wherein a placeholder is identified through the recognizable pattern, whereby the replacing eliminates the recognizable pattern.