Compiler assisted protection against arbitrary code execution

Patent metadata

Field	Value
Publication number	US-10152592-B2
Application number	US-201514965939-A
Country	US
Kind code	B2
Filing date	Dec 11, 2015
Priority date	Dec 11, 2015
Publication date	Dec 11, 2018
Grant date	Dec 11, 2018

Abstract

A method, computer program product, and computer system are provided. A processor receives an executable file for execution by an operating system, where the executable file includes a plurality of sections in a first order. A processor determines a second order that indicates a loading order for the plurality of sections, where the second order is distinct from the first order. A processor loads the plurality of sections of the executable file into a plurality of locations in memory of a device based on the second order. A processor resolves one or more memory references for the plurality of sections based on the plurality of locations in memory. A processor executes the plurality of sections of the executable file in the plurality of locations in memory.

First claim

What is claimed is:

1. A method comprising:
receiving, by one or more processors, an executable file for execution by an operating system, wherein the executable file includes a plurality of sections in a first order;
determining, by the one or more processors, a second order that indicates a loading order for the plurality of sections, wherein the second order is distinct from the first order;
loading, by the one or more processors, the plurality of sections of the executable file into a plurality of locations in memory of a device based, at least in part, on the second order;
resolving, by the one or more processors, one or more memory references for the plurality of sections based, at least in part, on the plurality of locations in memory; and
executing, by the one or more processors, the plurality of sections of the executable file in the plurality of locations in memory.

2. The method of claim 1 , wherein the load order is based, at least in part, on a random selection of the plurality of sections.

3. The method of claim 1 , wherein the load order is based, at least in part, on a selection of a predetermined permutation of the plurality of sections.

4. The method of claim 3 , the method further comprising:
responsive to a selection of the predetermined permutation of the plurality of sections, updating, by the operating system, the executable file with an indication of a use of the predetermined permutation for load order, wherein a subsequent execution of the executable file removes the predetermined permutation from selection.

5. The method of claim 1 , wherein the plurality of sections of the executable file correspond to one or more following statements in a source code file: (i) one or more method declaration statements; (ii) one or more code block statements; or (iii) one or more user-designated statements.

6. The method of claim 5 , wherein the plurality of sections of the executable file are indicated by a pre-determined machine-readable instruction.

7. The method of claim 5 , wherein the plurality of sections of the executable file are indicated by a pre-determined label.

8. A computer program product comprising:
one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions comprising:
program instructions to receive an executable file for execution by an operating system, wherein the executable file includes a plurality of sections in a first order;
program instructions to determine a second order that indicates a loading order for the plurality of sections, wherein the second order is distinct from the first order;
program instructions to load the plurality of sections of the executable file into a plurality of locations in memory of a device based, at least in part, on the second order;
program instructions to resolve one or more memory references for the plurality of sections based, at least in part, on the plurality of locations in memory; and
program instructions to execute the plurality of sections of the executable file in the plurality of locations in memory.

9. The computer program product of claim 8 , wherein the load order is based, at least in part, on a random selection of the plurality of sections.

10. The computer program product of claim 8 , wherein the load order is based, at least in part, on a selection of a predetermined permutation of the plurality of sections.

11. The computer program product of claim 10 , the program instructions further comprising:
responsive to a selection of the predetermined permutation of the plurality of sections, updating, by the operating system, the executable file with an indication of a use of the predetermined permutation for load order, wherein a subsequent execution of the executable file removes the predetermined permutation from selection.

12. The computer program product of claim 8 , wherein the plurality of sections of the executable file correspond to one or more following statements in a source code file: (i) one or more method declaration statements; (ii) one or more code block statements; or (iii) one or more user-designated statements.

13. The computer program product of claim 12 , wherein the plurality of sections of the executable file are indicated by a pre-determined machine-readable instruction.

14. The computer program product of claim 12 , wherein the plurality of sections of the executable file are indicated by a pre-determined label.

15. A computer system comprising:
one or more computer processors;
one or more computer readable storage media; and
program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising:
program instructions to receive an executable file for execution by an operating system, wherein the executable file includes a plurality of sections in a first order;
program instructions to determine a second order that indicates a loading order for the plurality of sections, wherein the second order is distinct from the first order;
program instructions to load the plurality of sections of the executable file into a plurality of locations in memory of a device based, at least in part, on the second order;
program instructions to resolve one or more memory references for the plurality of sections based, at least in part, on the plurality of locations in memory; and
program instructions to execute the plurality of sections of the executable file in the plurality of locations in memory.

16. The computer system of claim 15 , wherein the load order is based, at least in part, on a random selection of the plurality of sections.

17. The computer system of claim 15 , wherein the load order is based, at least in part, on a selection of a predetermined permutation of the plurality of sections.

18. The computer system of claim 17 , the program instructions further comprising:
responsive to a selection of the predetermined permutation of the plurality of sections, updating, by the operating system, the executable file with an indication of a use of the predetermined permutation for load order, wherein a subsequent execution of the executable file removes the predetermined permutation from selection.

19. The computer system of claim 15 , wherein the plurality of sections of the executable file correspond to one or more following statements in a source code file: (i) one or more method declaration statements; (ii) one or more code block statements; or (iii) one or more user-designated statements.

20. The computer system of claim 19 , wherein the plurality of sections of the executable file are indicated by a pre-determined machine-readable instruction.

Assignees

• IBM

Inventors

• Boehm Omer Y
• Shajrawi Yousef

Classifications

• G06F3/0673

  Single storage device · CPC title

• G06F3/0643

  Management of files · CPC title

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F3/0622

  in relation to access · CPC title