Automatic modification of executable code

A system for automatically modifying an executable file for a software agent to be compatible with integrity services environment, the system comprising:

• a processor;
• a memory including computer-executable instructions, the computer-executable instructions when executed by the processor causes the processor to perform the steps of:
• searching import and export tables in the executable file to detecting one or more first static entry and exit points in the executable file;
• generating, in a wrapper binary, one or more second entry and exit points corresponding to the first entry and exit points;
• generating in the wrapper binary a new import table and a new export table that point to the generated one or more second entry and exit points;
• merging the executable file with the wrapper binary to produce a merged executable file;
• modifying the merged executable file to link to the integrity services environment, to produce a modified executable file;
• embedding an agent manifest into the modified executable file;
• loading the modified executable file into a first memory location referred to by a first page table;
• registering the software agent with a memory protection module, in response to successfully verifying the executable file's integrity using the manifest;
• registering a target list with a hypervisor for the software agent, wherein the target list provides mappings between the first page table and a second page table;
• detecting one or more third dynamic entry and exit points in the executable file, the detecting includes detecting a third dynamic exit point and a related dynamic exit point that is called when the third dynamic exit point is invoked;
• generating one or more fourth entry and exit points corresponding to the third entry and exit points, the generating the one or more fourth entry and exit points includes generating a fourth exit point and a related exit point, to replace the detected third dynamic exit point and the related dynamic exit point, respectively;
• switching to a first mode, in response to a second or fourth exit point being invoked, wherein the first mode protects the software agent from memory attacks;
• switching to a second mode, in response to a second or fourth entry point being invoked, wherein the second mode does not protect the software agent from memory attacks;
• the invoking the fourth exit point includes allocating a dynamic context and storing therein code associated with the detected third dynamic exit point and its related dynamic exit point, switching to the second mode, invoking the detected third dynamic exit point so as to call the related exit point in the dynamic context, and switching to the first mode;
• and
• de-registering the software agent with the memory protection module, in response to the software agent being unloaded.

A non-transitory computer readable medium encoded with a computer program to modify an executable file for a software agent to be compatible with an integrity services environment, the computer program including instructions to cause a processor to:

• searching import and export tables in the executable file to detecting one or more first static entry and exit points in the executable file;
• generating, in a wrapper binary, one or more second entry and exit points corresponding to the first entry and exit points;
• generating in the wrapper binary a new import table and a new export table that point to the generated one or more second entry and exit points;
• merging the executable file with the wrapper binary to produce a merged executable file;
• modifying the merged executable file to link to the integrity services environment, to produce a modified executable file;
• embedding an agent manifest into the modified executable file;
• loading the modified executable file into a first memory location referred to by a first page table;
• registering the software agent with a memory protection module, in response to successfully verifying the executable file's integrity using the manifest;
• registering a target list with a hypervisor for the software agent, wherein the target list provides mappings between the first page table and a second page table;
• detecting one or more third dynamic entry and exit points in the executable file, the detecting includes detecting a third dynamic exit point and a related dynamic exit point that is called when the third dynamic exit point is invoked;
• generating one or more fourth entry and exit points corresponding to the third entry and exit points, the generating the one or more fourth entry and exit points includes generating a fourth exit point and a related exit point, to replace the detected third dynamic exit point and the related dynamic exit point, respectively;
• switching to a first mode, in response to a second or fourth exit point being invoked, wherein the first mode protects the software agent from memory attacks;
• switching to a second mode, in response to a second or fourth entry point being invoked, wherein the second mode does not protect the software agent from memory attacks;
• the invoking the fourth exit point includes allocating a dynamic context and storing therein code associated with the detected third dynamic exit point and its related dynamic exit point, switching to the second mode, invoking the detected third dynamic exit point so as to call the related exit point in the dynamic context, and switching to the first mode;
• and
• de-registering the software agent with the memory protection module, in response to the software agent being unloaded.