Dynamic code insertion and removal for static analysis based sandboxes

Patent metadata

Field	Value
Publication number	US-8997225-B2
Application number	US-201313967626-A
Country	US
Kind code	B2
Filing date	Aug 15, 2013
Priority date	Dec 3, 2009
Publication date	Mar 31, 2015
Grant date	Mar 31, 2015

Abstract

Methods and apparatus for dynamically adding and deleting new code to previously validated application executing in a secured runtime. New code is written to a portion of secured memory not executable by application. New code is validated to ensure it cannot directly call operating system, address memory outside of secured memory, or modify secured memory state. Indirect branch instructions may only target addresses aligned on fixed size boundaries within the secured memory. Validated code is copied to portion of secured memory executable by application in two stage process that ensures partially copied segments cannot be executed. Validated new code can be deleted once all threads reach safe execution point, provided code was previously inserted as unit or contains no internal targets that can be called by code not also being deleted.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
executing a first piece of code in a sandboxed application that is written to a secured memory;
dynamically writing a new piece of code into code of the sandboxed application during runtime to a portion of the secured memory that cannot be executed by the sandboxed application;
validating the new piece of code; and
in response to a successful validation, writing the validated piece of code to a portion of the…

Assignees

• Google Inc

Inventors

• Yee Bennet S
• Sehr David C
• Biffle Cliff L

Classifications

• G06F21/53 Primary

  Physics · mapped topic

• G06F9/445

  Physics · mapped topic

• G06F9/30054

  Physics · mapped topic

• G06F9/323

  Physics · mapped topic

• G06F9/30061

  Physics · mapped topic