Reorganization of virtualized computer programs

Patent metadata

Field	Value
Publication number	US-8984478-B2
Application number	US-201213549410-A
Country	US
Kind code	B2
Filing date	Jul 13, 2012
Priority date	Oct 3, 2011
Publication date	Mar 17, 2015
Grant date	Mar 17, 2015

Abstract

In an embodiment, a data processing method comprises obtaining access to computer program code; identifying a plurality of code segments in the computer program code; reorganizing the computer program code into reorganized code, by re-ordering the plurality of code segments into a new order that is potentially different than an original order of the plurality of code segments; wherein the new order is unpredictable based on the original order; rewriting one or more pointers of the reorganized code to point to new locations in the reorganized code consistent with the order of the reorganized code; wherein the method is performed by one or more computing devices.

First claim

What is claimed is:

1. A computer-implemented method comprising:
obtaining access to computer program code;
identifying a plurality of code segments in the computer program code, the plurality of code segments organized in an original order;
obtaining stored information indicating a previous reorganization of the plurality of code segments in a particular previous reorganization order that is different than the original order;
reorganizing the computer program code into reorganized code, by re-ordering the plurality of code segments into a new order that is potentially different than the original order of the plurality of code segments and the particular previous reorganization order of the plurality of code segments;
wherein the new order is unpredictable based on the original order and the particular previous reorganization of the plurality of code segments;
rewriting one or more pointers of the reorganized code to point to new locations in the reorganized code consistent with the new order of the reorganized code;
wherein the method is performed by one or more computing devices.

2. The computer-implemented method of claim 1 wherein the reorganizing comprises moving one or more functions to randomly selected new locations within the reorganized code.

3. The computer-implemented method of claim 1 wherein the reorganizing comprises reorganizing a plurality of instructions within a particular code segment by any of swapping instruction locations, relocating instructions, or spacing instructions by inserting a randomly selected number of no-operation instructions.

4. The computer-implemented method of claim 1 wherein the reorganizing comprises substituting, in the reorganized code, randomly selected identifiers of registers that are referenced in the computer program code.

5. The computer-implemented method of claim 1 wherein the reorganizing comprises modifying an order, within a stack, of local function variables.

6. The computer-implemented method of claim 5 further comprising adding randomly selected padding bytes in the stack.

7. The computer-implemented method of claim 1 wherein the rewriting comprises rewriting instruction pointers to point properly to locations within the reorganized code that correspond to original locations in the computer program code, and rewriting data segment pointers to reference new locations of data segments in the reorganized code.

8. The computer-implemented method of claim 1 further comprising repeating the method periodically while the reorganized code is in memory.

9. The computer-implemented method of claim 1 wherein the new order is pseudo-random or random.

10. The computer-implemented method of claim 1 further comprising:
retrieving stored information indicating the new order corresponding to the reorganized code;
selecting a different new order that is unpredictable from the new order;
updating the stored information to indicate the different new order;
again reorganizing the reorganized code according to the different new order.

11. The computer-implemented method of claim 1 further comprising:
detecting that a computer is loading a dynamic loader;
allowing loading the dynamic loader into memory and then suspending operation of the dynamic loader;
modifying the dynamic loader in memory to redirect one or more system or library call instructions of the dynamic loader to cause referencing the reorganized code;
updating a binary header of the reorganized code to reflect the new order;
allowing the dynamic loader to load the reorganized code based on the binary header after the updating.

12. The computer-implemented method of claim 11 , wherein the modifying comprises modifying one or more file OPEN calls to redirect the dynamic loader to a different file that contains the reorganized code.

13. The computer-implemented method of claim 11 , wherein the modifying comprises:
creating and storing a private memory map for the reorganized code;
detecting that the dynamic loader has issued a first system or library call to open a file;
in response to the dynamic loader issuing a second system or library call to read a file that correlates to the first system call that was previously detected, intercepting the second system call and returning a portion of the reorganized code based on the private memory map.

14. The computer-implemented method of claim 13 , further comprising, in response to the dynamic loader issuing the second system or library call that correlates to the first system or library call that was previously detected:
modifying the second system or library call to comprise a memory allocation call;
storing, in memory allocated as a result of the memory allocation call, a portion of the reorganized code.

15. The computer-implemented method of claim 11 wherein the first system or library call is an OPEN system or library call and the second system or library call is a READ or MMAP system or library call.

16. The computer-implemented method of claim 11 , further comprising:
detecting that the dynamic loader has requested a shared memory map of a file;
modifying the shared memory map to a private map call with no file;
storing, in memory allocated as a result of the private map call, a portion of the reorganized code.

17. The computer-implemented method of claim 16 , further comprising using a shared private call or shared memory call to allocate and name shared memory.

18. The computer-implemented method of claim 11 , further comprising rewriting a plurality of pointers to reference a non-shared segment of data that is configured to remap the pointers to particular locations in the reorganized code.

19. The computer-implemented method of claim 11 further comprising enabling an inherent random segment loading capability of the dynamic loader, in response to detecting that the computer is loading the dynamic loader.

20. The computer-implemented method of claim 1 , further comprising:
storing a backup copy of the computer program code;
during execution of the reorganized code:
setting memory page permissions of all pages of memory of the reorganized code to not readable, not writeable, and executable;
in response to detecting a trap resulting from an attempt to read or write a particular one of the pages of memory of the reorganized code, returning an original page from the stored backup copy of the computer program code that corresponds to the particular one of the pages of memory of the reorganized code.

21. The computer-implemented method of claim 1 further comprising:
storing locations of function pointers in the computer program code;
retrieving stored information indicating the new order that was used in a previous reorganization of the reorganized code;
selecting a different new order that is unpredictable;
updating the stored information to indicate the different new order;
identifying, using a pattern recognition method, one or more pointers on a stack;
re-aligning the one or more pointers on the stack, based on the stored locations of the function pointers, to reference corresponding locations in the newly reorganized code.

22. The computer-implemented method of claim 21 further comprising again reorganizing the reorganized code according to the different new order to result in newly reorganized code.

23. The computer-implemented method of claim 21 further comprising:
detecting one or more re-aligned pointers that jump to non-existent locations

Assignees

• Epstein Joe
• Cisco Tech Inc

Inventors

• Epstein Joe

Classifications

• G06F2009/45583

  Memory management, e.g. access or allocation · CPC title

• G06F12/145 Primary

  the protection being virtual, e.g. for virtual blocks or segments before a translation mechanism · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2212/151

  Emulated environment, e.g. virtual machine · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title