Reorganization of virtualized computer programs

Patent metadata

Field	Value
Publication number	US-9535855-B2
Application number	US-201514656409-A
Country	US
Kind code	B2
Filing date	Mar 12, 2015
Priority date	Oct 3, 2011
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

In an embodiment, a data processing method comprises detecting that a computer is loading a dynamic loader in a user space, the dynamic loader intending to load computer program code; allowing loading the dynamic loader into memory and then suspending operation of the dynamic loader; reorganizing the computer program code into reorganized code by re-ordering a plurality of code segments into a new order that is potentially different than an original order of the plurality of code segments; modifying the dynamic loader in memory to redirect one or more system or library call instructions of the dynamic loader to cause referencing the reorganized code; updating a binary header of the reorganized code to reflect the new order; allowing the dynamic loader to load the reorganized code based on the binary header after the updating.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
detecting that a computer is loading a dynamic loader in a user space, wherein the dynamic loader is configured to load computer program code;
allowing, by security logic, loading the dynamic loader into memory and then suspending operation of the dynamic loader;
reorganizing the computer program code into reorganized code by re-ordering a plurality of code segments of the computer program code into a new order that is different than an original order of the plurality of code segments;
modifying, by the security logic, the dynamic loader in the memory to redirect one or more system or library call instructions of the dynamic loader to cause referencing the reorganized code;
updating, by the security logic, a binary header of the reorganized code to reflect the new order;
after the updating, allowing, by the security logic, the dynamic loader to load the reorganized code based on the binary header;
wherein the method is performed by one or more computing devices.

2. The method of claim 1 , wherein the modifying comprises modifying one or more file OPEN calls to redirect the dynamic loader to a different file that contains the reorganized code.

3. The method of claim 1 , wherein the modifying comprises:
creating and storing a private memory map for the reorganized code;
detecting that the dynamic loader has issued a first system or library call to open a file;
in response to the dynamic loader issuing a second system or library call to read a file that correlates to the first system call that was previously detected, intercepting the second system call and returning a portion of the reorganized code based on the private memory map.

4. The method of claim 3 , further comprising, in response to the dynamic loader issuing the second system or library call that correlates to the first system or library call that was previously detected:
modifying the second system or library call to comprise a memory allocation call;
storing, in memory allocated as a result of the memory allocation call, a portion of the reorganized code.

5. The method of claim 1 wherein the first system or library call is an OPEN system or library call and the second system or library call is a READ or MMAP system or library call.

6. The method of claim 1 , further comprising:
detecting that the dynamic loader has requested a shared memory map of a file;
modifying the shared memory map to a private map call with no file;
storing, in memory allocated as a result of the private map call, a portion of the reorganized code.

7. The method of claim 6 , further comprising using a shared private call or shared memory call to allocate and name shared memory.

8. The method of claim 1 , further comprising rewriting a plurality of pointers to reference a non-shared segment of data that is configured to remap the pointers to particular locations in the reorganized code.

9. The method of claim 1 , further comprising enabling an inherent random segment loading capability of the dynamic loader, in response to the detecting.

10. The method of claim 1 , further comprising validating code segment linkages in the computer program code.

11. One or more non-transitory computer-readable media storing one or more sequences of instructions which when executed cause one or more computing devices to perform:
detecting that a computer is loading a dynamic loader in a user space, wherein the dynamic loader is configured to load computer program code;
allowing, by security logic, loading the dynamic loader into memory and then suspending operation of the dynamic loader;
reorganizing the computer program code into reorganized code by re-ordering a plurality of code segments of the computer program code into a new order that is different than an original order of the plurality of code segments;
modifying, by the security logic, the dynamic loader in the memory to redirect one or more system or library call instructions of the dynamic loader to cause referencing the reorganized code;
updating, by the security logic, a binary header of the reorganized code to reflect the new order;
after the updating, allowing, by the security logic, the dynamic loader to load the reorganized code based on the binary header.

12. The non-transitory computer-readable media of claim 11 , wherein the modifying comprises modifying one or more file OPEN calls to redirect the dynamic loader to a different file that contains the reorganized code.

13. The non-transitory computer-readable media of claim 11 , wherein the modifying comprises:
creating and storing a private memory map for the reorganized code;
detecting that the dynamic loader has issued a first system or library call to open a file;
in response to the dynamic loader issuing a second system or library call to read a file that correlates to the first system call that was previously detected, intercepting the second system call and returning a portion of the reorganized code based on the private memory map.

14. The non-transitory computer-readable media of claim 13 , wherein the one or more sequences of instructions further cause the one or more computing devices to perform, in response to the dynamic loader issuing the second system or library call that correlates to the first system or library call that was previously detected:
modifying the second system or library call to comprise a memory allocation call;
storing, in memory allocated as a result of the memory allocation call, a portion of the reorganized code.

15. The non-transitory computer-readable media of claim 11 , wherein the first system or library call is an OPEN system or library call and the second system or library call is a READ or MMAP system or library call.

16. The non-transitory computer-readable media of claim 11 , wherein the one or more sequences of instructions further cause the one or more computing devices to perform:
detecting that the dynamic loader has requested a shared memory map of a file;
modifying the shared memory map to a private map call with no file;
storing, in memory allocated as a result of the private map call, a portion of the reorganized code.

17. The non-transitory computer-readable media of claim 16 , wherein the one or more sequences of instructions further cause the one or more computing devices to perform using a shared private call or shared memory call to allocate and name shared memory.

18. The non-transitory computer-readable media of claim 11 , wherein the one or more sequences of instructions further cause the one or more computing devices to perform rewriting a plurality of pointers to reference a non-shared segment of data that is configured to remap the pointers to particular locations in the reorganized code.

19. The non-transitory computer-readable media of claim 11 , wherein the one or more sequences of instructions further cause the one or more computing devices to perform enabling an inherent random segment loading capability of the dynamic loader, in response to the detecting.

20. The non-transitory computer-readable media of claim 11 , wherein the one or more sequences of instructions further cause the one or more computing devices to perform validating code segment linkages in the computer program code.

Assignees

• Cisco Tech Inc

Inventors

• Epstein Joseph

Classifications

• G06F9/44563

  Sharing · CPC title

• G06F9/45533

  Hypervisors; Virtual machine monitors · CPC title

• G06F12/1433

  for a module or a part of a module · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F2212/1052

  Security improvement · CPC title