Method and apparatus for partitioning executable code into randomization units

Abstract

A method and apparatus for preventing code reuse attacks is presented. Memory locations of executable code are modified when preparing the code for execution by randomly shuffling randomization units whose size is a multiple of the system memory page size. Complete functions are partitioned into a plurality of randomization units. Extra data is then added to each randomization unit to create a desired randomization unit size. The extra data may be filled with useful information such as partitioning and relocation information or additional function code to reduce program file size. When the program is loaded, a random permutation is computed, then the randomization units are relocated in memory according to the random permutation.

Description

[0001] METHOD AND APPARATUS FOR PARTITIONING EXECUTABLE CODE INTO RANDOMIZATION UNITS

[0002] TECHNICAL FIELD

[0003] The aspects of the disclosed embodiments relate generally to computer security and more particularly to countermeasures for preventing code-reuse attacks.

[0004] BACKGROUND

[0005] Code-reuse attacks, such as return oriented programming (ROP) and jump oriented programming (JOP), exploit valid code sequences, called gadgets, for malicious purposes. Address-space layout randomization (ASLR), a common countermeasure against code-reuse, loads executable code modules based on a randomly selected base address. ASLR modifies the location of gadgets, but does not alter relative positions of gadgets within the code. Thus, an attacker who identifies the address of one gadget is able to locate other gadgets based on their relative positions.

[0006] Function-granular ASLR (FGASLR) improves on ASLR by randomizing the order and locations of functions within the code. FGASLR provides improved protection against code-reuse attacks at the cost of increased file sizes and increased load times.

[0007] Thus, there is a need for improved code-reuse countermeasures that can provide improved protection against codereuse without the increased file size and relocation time of FGASLR. Accordingly, it would be desirable to provide methods and apparatus that addresses at least some of the problems described above.

[0008] SUMMARY

[0009] The aspects of the disclosed embodiments are directed to methods and apparatus for partitioning executable code into randomization units. The disclosed embodiments provide improved protection against code-reuse attacks while maintaining relatively small file sizes and supporting efficient loading and relocation of the executable code.

[0010] According to a first aspect, the above and further advantages are obtained by a method for partitioning an executable code, where the executable code includes a plurality of functions. The method includes: partitioning the executable code into a plurality of randomization units wherein a unit size of each randomization unit in the plurality of randomization units is a multiple of a system memory page size. The partitioning includes: copying one or more complete functions from the plurality of functions into a first randomization unit in the plurality of randomization units, and padding the first randomization unit with a first extra data. The first extra data includes a no-operation data, and a size of the first extra data is configured to form a size of the first randomization unit that is a multiple of the system memory page size.

[0011] In a possible implementation form, the method further includes replacing at least a portion of the first extra data with one or more of a partitioning information and a relocation information. Replacing no-operation data with useful data, such as relocation and partitioning information reduces the randomizable program file size.In a possible implementation form, the first extra data includes a first relocation information and the first relocation information includes all relocation information necessary to relocate the first one or more complete functions. Including all required relocation information within a single randomization unit, allows relocation of the loaded functions without loading any additional pages or accessing any additional data.

[0012] In a possible implementation form, the first extra data includes a first portion of the first relocation information and a second randomization unit comprises a second extra data and the second extra data comprises a second portion of the first relocation information and the first extra data comprises a link to the second relocation information. When relocation information needs to be split between multiple randomization units, including a link to additional required information can improve relocation time.

[0013] In a possible implementation form, the first extra data includes a complete function. Partitioning complete functions into the extra data provides flexibility and may reduce the resulting file size.

[0014] In a possible implementation form, the first extra data includes a first portion of a split function and a second extra data includes a second portion of the split function, and the first extra data includes an unconditional jump instruction configured to link the first portion of the split function to the second portion of the split function.

[0015] In a possible implementation form, the size of each randomization unit in the plurality of randomization units is a preconfigured multiple of the memory page size. Pre-configuration simplifies the partitioning process.

[0016] In a possible implementation form, the one or more functions in the plurality of functions comprises a literal pool. The disclosed partitioning method works equally well with literal pools as with functions.

[0017] In a possible implementation form, the method further comprises generating a randomizable program file, where the randomizable program file comprises the plurality of randomization units and an extra section. The extra section comprises one or more of a randomization unit partitioning information and a relocation information. Information necessary to load and relocate the plurality of randomization units is beneficially included in a binary program file.

[0018] According to a second aspect, the above and further advantages are obtained by a method for loading and executing a randomizable program file, where the randomizable program file includes a plurality of randomization units. Each randomization unit in the plurality of randomization units includes one or more complete functions, an extra data, and a randomization unit size that is a multiple of a system memory page size. The method includes: loading the randomizable program file; extracting useful information from the extra data; computing a random permutation; loading a page into memory; copying the page into a randomized memory address based on the computed random permutation; performing relocations on the page; and executing code from the page.In a possible implementation form, the extra data includes one or more of a partitioning information and a relocation information, and the performing relocations on the page is based at least in part on the partitioning information and the relocation information. Storing partitioning and relocation information in the extra data of a randomization unit reduces the size of the randomizable program file.

[0019] In a possible implementation form, the extra data includes one or more of a partitioning information and a relocation information, and performing relocations on the page is based at least in part on the partitioning information and the relocation information. Performing relocations based on information stored within the randomization units improves efficiency when relocating the randomization unit.

[0020] According to a third aspect, the above and further advantages are obtained by an apparatus configured to load and execute a randomizable program file, where the randomizable program file includes a plurality of randomization units. Each randomization unit in the plurality of randomization units includes: one or more complete functions; an extra data; and a randomization unit size that is a multiple of a system memory page size. The apparatus includes a processor, a random-access memory, and a program memory, where the program memory incudes non-transitory program instructions that when executed by the processor cause the processor to perform the method according to the second aspect.

[0021] In a possible implementation form, the extra data includes one or more of a partitioning information and a relocation information pertaining to the one or more complete functions. Including relocation and partitioning information within the extra data reduces the size of randomizable program files.

[0022] These and other aspects, implementation forms, and advantages of the exemplary embodiments will become apparent from the embodiments described herein considered in conjunction with the accompanying drawings. It is to be understood, however, that the description and drawings are designed solely for purposes of illustration and not as a definition of the limits of the disclosed invention, for which reference should be made to the appended claims. Additional aspects and advantages of the invention will be set forth in the description that follows, and in part will be obvious from the description, or may be learned by practice of the invention. Moreover, the aspects and advantages of the invention may be realized and obtained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

[0023] BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In the following detailed portion of the present disclosure, the invention will be explained in more detail with reference to the example embodiments shown in the drawings, in which like references indicate like elements and: Figure 1 illustrates a pictorial representation and flow chart of an exemplary method for partitioning executable code into randomization units incorporating aspects of the disclosed embodiments;

[0025] Figure 2 illustrates a pictorial diagram of an exemplary software system incorporating aspects of the disclosed embodiments;

[0026] Figure 3 illustrates a pictorial representation and flowchart of an exemplary method for partitioning an original text segment into a partitioned text segment incorporating aspects of the disclosed embodiments;Figure 4 illustrates a pictorial representation of an exemplary method for partitioning an original text segment into a partitioned text segment incorporating aspects of the disclosed embodiments;

[0027] Figure 5 illustrates an exemplary method for loading, randomizing, and running a randomizable program file incorporating aspects of the disclosed embodiments;

[0028] Figure 6 illustrates a block diagram of an exemplary computing system appropriate for implementing the herein disclosed methods incorporating aspects of the disclosed embodiments.

[0029] DETAILED DESCRIPTION OF THE DISCLOSED EMBODIMENTS

[0030] Figure 1 illustrates a pictorial representation 136 and flow chart 134 of an exemplary method 100 for partitioning executable code into randomization units incorporating aspects of the disclosed embodiments. The aspects of the disclosed embodiments are directed to a method 100 for preparing a software program that facilitates runtime randomization by partitioning executable code into blocks, referred to herein as randomization units 132. At runtime, these randomization units 132 are randomly shuffled in memory to dynamically modify memory locations of vulnerable sequences of code within the executable program, thereby improving protection against code-reuse attacks.

[0031] As illustrated in the embodiment of Figure 1, the executable code 108 comprises a plurality of functions 130 and the method 100 includes partitioning 126 the executable code 108 into a plurality of randomization units 132. A unit size of individual randomization units 112, 114, 116 in the plurality of randomization units 132 is a multiple of a system memory page size.

[0032] In one embodiment, the partitioning 126 includes copying 104 one or more complete functions Fl, F2, L2 from the plurality of functions 130 into a first randomization unit 112 in the plurality of randomization units 132 and padding 128 the first randomization unit 112 with a first extra data 120. In one embodiment, the first extra data 120 has a no-operation data, and a size of the first extra data 120 is configured to form a size of the first randomization unit 112 that is a multiple of the system memory page size.

[0033] Data transformations created by the exemplary method 100 are depicted in the pictorial representation 136 where an original text segment 108 with a plurality of executable software functions 130, is partitioned into a plurality of randomization units 132, which are incorporated into a partitioned text segment 118.

[0034] As an aid to understanding, the illustrated embodiment shows how an original text segment 108 with five functions Fl, F2, F3, F4, F5 and a literal pool L2 is partitioned to form a partitioned text segment 118 incorporating three randomization units 112, 114, 116. Those skilled in the art will readily recognize that an original text segment 108 having any number of one or more functions may be partitioned into a plurality of randomization units having any number of two or more randomization units without departing from the spirit and scope of the present disclosure. To more clearly illustrate the partitioning process, the three randomization units 112, 114, 116 are illustrated both separately 132 and combined into the partitioned text segment 118. In practice, the randomization units 112, 114, 116 need not be formed separately 132, but may, when desired, be created directly within the partitioned text segment 118.Atacks that remotely change the behavior of valid software have for a long time been one of the most severe kinds of atacks against software systems and computing devices. Fortunately, in today’s computing apparatuses and operating systems, atackers can no longer directly inject malicious code into programs via buffer write overflow vulnerabilities. Buffer overflow attacks are prevented by employing a data segment that is not executable. However, code-reuse atacks, where existing code is used for malicious purposes, remains a serious risk.

[0035] In code-reuse atacks, the atacker typically exploits a stack buffer write overflow vulnerability to overwrite the return address of a function. In fact, since return addresses are pushed onto the stack, the atacker can inject multiple addresses. When a function returns, these addresses are jumped to in a chain. The attacker can locate useful code sequences (often referred to as gadgets) in advance by studying the binary code of the victim program. Each gadget ends in a return instruction. Because most instructions that branch to a function push the return address onto the stack, such as branches performed using branch and link (BL) instruction used in the ARM A64 architecture, an atacker can change the return address using the stack buffer overflow vulnerability. Similarly, many registers are pushed to the stack before taking a branch. Thus, the register values (often used as arguments to functions) can also be changed by the attacker. The attacker can thus modify return addresses and function arguments to piece together gadgets that perform a useful attack. Some code-reuse atacks may even allow disabling the no-execute permission from data pages, thus making code injection attacks again possible.

[0036] Code randomization (CR) is a countermeasure against code-reuse atacks. In CR, executable code is randomly relocated in memory making it more difficult for an attacker to locate the desired gadgets. In conventional computing systems, the only widely deployed form of CR is address space layout randomization (ASLR) which randomizes the process’ load addresses. Unfortunately, ASLR has a drawback where an atacker who manages to find out the address of just one function, can easily compute the offset to locate other functions and gadgets within the relocated code. The attacker subsequently only needs to add the offset to his pre-discovered gadget addresses to make them useful again.

[0037] Some CR methods go further than just randomizing the load address. For example, kernel function-granular address space layout randomization (FGASRL) shuffles the functions within a binary. Fine-grained randomization methods are not currently widely used and have the drawback of requiring a large amount of relocation information and can slow program loading.

[0038] CR changes the memory locations of functions and data associated with executable code, thereby invalidating existing address references within that code. As used herein, the term “relocation” refers to the process of fixing up address references within an executable code to account for load-time changes in memory locations of the referenced code. Relocation is performed by a linker using relocation information stored in relocation entries in data segments of the executable binary.

[0039] Relocation entries included in program files describe the address of CPU instmctions to be fixed up, and a symbol relative to which the fixup should be made. For example, the symbol could be a function symbol for a call, suchas a call based on a BL instruction. There are two main categories of relocations: static relocations, which are performed by the linker at build / link time; and dynamic relocations, which are performed by a dynamic linker at program load time. Static relocation entries are no longer required once static linking is completed and are usually removed from the final executable file by the linker. There are typically far fewer dynamic relocation entries than static relocation entries. Relocation is a time-consuming process and relocation entries take up a significantly large portion of the executable fde.

[0040] The exemplary method 100 begins by compiling and linking 102 a library or other desired source code to produce a binary fde that includes executable code within a text segment 108, which may be referred to herein as an original text segment 108. When desired, additional information may be included in the binary file along with the text segment 108. For example, it may be beneficial to include a data segment with symbol and other information useful when loading and executing the executable code in the original text segment 108. Any suitable binary file format may be used to store the original text segment 108. For example, in one embodiment, the original text segment 108 may be incorporated into a binary fde format such as the standardized executable and linkable format file (.elf file) commonly used in Linux operating systems.

[0041] All operating systems used in today’s computer systems implement a virtual memory space that is organized into pages, and handle memory operations based on the size of these pages. The page size used by the operating system for handling memory operations is referred to herein as the system memory page size. Memory is addresses in terms of a page number and an offset within the page. Only full virtual pages can be fetched or written to caches, and access permissions are applied to whole pages. A typical page size used in today’s computer system is 4096 bytes, often referred to as 4 kilobytes (KB). Memory operations are typically most efficient when memory operations are applied to a number of bytes that is an even multiple of the system memory page size. For example, reading a single 4KB page is much faster than reading a first 2KB from one page and a second 2KB from a different page.

[0042] Executable code, such as a program or library, stored in the original text segment 108 includes a plurality of functions 130, such as the five individual functions Fl, F2, F3, F4, F5 and one literal block L2 illustrated in Figure 1. Optionally, the original text segment 108 may include empty space 110. Empty space 110 may be added to the original text segment 108, for example, to ensure a size the original text segment 108 is an even multiple of the system memory page size.

[0043] To facilitate randomization during loading, the executable code 108 is partitioned 126 into a plurality of randomization units 132 wherein a unit size of each randomization unit 112, 114, 116 in the plurality of randomization units 132 is a multiple of a system memory page size. Making the size, or unit size, of each randomization unit a multiple of the system memory page size improves performance by allowing the operating system to load full pages into memory. As used herein, the term “a multiple of the system memory page size” refers to an even positive integer multiple of the system memory page size.More particularly, partitioning 126 the executable code 108 into a plurality of randomization units 132 includes copying 104 one or more complete functions Fl, F2, L2 from the plurality of functions 130 into a first randomization unit 112 in the plurality of randomization units 132. Beneficially, complete functions Fl, F2, L2 are copied 104 into each randomization unit. An extremely complex situation arises when a partial function is copied to a first randomization unit and the remaining portion of the function is copied to a different randomization unit. Splitting a function between multiple randomization units would cause a function to be only partially relocated when the first randomization unit is loaded into memory, thereby forcing loading of multiple pages at the same time to relocate the function as a whole.

[0044] Once the desired one or more complete functions have been copied to a randomization unit 112, remaining space 120, i.e. memory space 120 between the end of the one or more functions Fl, F2, L2 and the end of the randomization unit, is padded 106 with extra data such as a no-operation (NOP) data. The space 120, 122, 124 being padded 106 is referred to herein either as “extra data” or a padding block. As used herein the operation of padding refers to adding a quantity of data to a randomization unit where the combined size of the added quantity of extra data and the size of the one or more functions Fl, F2, L2 results in a randomization unit whose size is a multiple of the system memory page size.

[0045] The data NOP used for the padding 128 may be any desired data value. For example, in certain embodiments, the data NOP may be a no-operation data, also referred to as a no-operation instruction. A no-operation instruction is a special processor instruction that consumes one or more clock cycles but doesn’t do anything. A no-operation instruction does not move any data, does not change any register values, and simply increments the instruction pointer to the next instruction in memory.

[0046] In the illustrated pictorial representation 136 the plurality of randomization units 132 includes three randomization units 112, 114, 116. Three complete functions Fl, F2, L2 are copied into the first randomization unit 112, then the first randomization unit 112 is padded with a first extra data 120. A third complete function F3 is copied into the second randomization unit 114, then the second randomization unit 114 is padded with extra data 122. A fourth function F4 and a fifth function F5 are copied into the third randomization unit 116, then the third randomization unit 116 is padded with extra data 124. The padding results in each of the randomization units 112, 114, 116 having a size that is a multiple of the system memory page size, such as the eight pages shown in the illustrated embodiment.

[0047] The randomization units 112, 114, 116 are assembled within a partitioned text segment 118 to produce partitioning of the executable code from the original text segment 108 into a plurality of partitioned text segment 118 containing a plurality of randomization units 112, 114, 116 configured to facilitate efficient code randomization at runtime.

[0048] Figure 2 illustrates a pictorial diagram of an exemplary software system 200 incorporating aspects of the disclosed embodiments. In the exemplary software system 200, a binary file 202 that includes executable code 208 is converted during build time 232 to a randomizable program file 214 configured to support efficient randomizationduring run time 234. The exemplary computing system 200 provides improved and efficient countermeasures against code-reuse attacks.

[0049] At build time 234 any suitable build process may be used to create a binary program file 202 that includes executable code 208 such as a software program or library. The program file 202 may be any desired binary file format appropriate for storage and subsequent loading of executable code 208. In certain embodiments the program file 202 may be a standardized executable and linkable formatted file (.elf) that includes header information 204, a text segment 206 with executable code 208, and a data segment 210 to provide symbols and other information useful when loading and executing the software program or library.

[0050] A binary rewrite tool 212 reads the program file 202 and generates 230 a randomizable program file 214, where the randomizable program file 214 includes a text segment 218 with a plurality of randomization units 220, such as the plurality of randomization units 132 described above and with reference to Figure 1. As discussed above, the executable code 208 is partitioned into the plurality of randomization units 220 in a fashion that facilitates randomized loading of the executable code at runtime 234.

[0051] Included in the exemplary randomizable program file 214 is a header 216 configured to provide general information about the program file, the text segment 218 including the plurality of randomization units 220, a data segment 222 with information such as symbols and other useful program information, and an extra segment 224 with partitioning information and relocation entries to support randomization and linking of the plurality of randomization units 220. The term “partitioning information” as used herein refers to information describing how the original text segment 206 with the executable code and plurality of functions 208 it contains is partitioned into the plurality of randomization units 220.

[0052] At runtime 234, the randomizable program file 214 is loaded 226 and prepared for execution by an operating system (OS) loader. Reading and loading of the randomizable program file 214 may be performed by any suitably configured loader. For example, in one embodiment a conventional OS loader may be enhanced with a randomization plugin. Alternatively, a loader may be created to generate a random permutation and page the plurality of randomization units into memory and relocate 228 them based on the generated random permutation.

[0053] Figure 3 illustrates a pictorial representation 302 and flowchart 304 of an exemplary method 300 for partitioning an original text segment 108 into a partitioned text segment 318 incorporating aspects of the disclosed embodiments. The exemplary method 300 is similar to the exemplary method 100 described above and with reference to Figure 1, where like references indicate like elements. As will be discussed further below, the exemplary method 300 is configured to reduce the randomizable program size by storing useful information in extra data blocks when the randomization units are padded thereby reducing the amount of partitioning and randomization information stored in the extra section of a program file, such as the extra section 224 of the randomizable program file 214 described above.In the exemplary method 100 described above, each randomization unit is padded with no-operation data to create randomization units having a size that is a multiple of the system memory page size. In the exemplary method 300 the extra data 120, 122, 124 is padded or replaced 312 with useful information rather than the no-operation data inserted in the exemplary method 100 described above. Replacing 312 the no-operation data with useful information, such as portions of the partitioning information and relocation information stored in the extra segment 224 of a randomizable program file 214, allows the size of the randomizable program file 214 to be reduced.

[0054] In embodiments where the extra data 120, 122. 124 is to be replaced with useful information, such as partitioning and relocation information 316, there is no need to use time to write specific no-operation data , such as a nooperation processor instruction, into the extra data 120, 122, 124. Because the extra data 120, 122, 124 will be replaced with useful information 316, whatever data values are placed there during memory allocation are suitable as the no-operation data padding.

[0055] To take advantage of potential size reduction provided by moving useful information to the extra data, the exemplary method 300 adds additional steps to the exemplary method 100 described above to replace 312 at least a portion of the first extra data 120 with one or more of a partitioning information and a relocation information 316 to produce an extra data 120 that includes useful information 316. Useful information 316 may be added to all extra data 306, 308, 310 in the plurality of randomization units in the partitioned extra segment 318. Any desired information, such as partitioning and / or relocation information, may be advantageously stored in the extra data 306, 308, 310 of each randomization unit 112, 114, 116 without departing from the spirit and scope of the disclosed embodiments.

[0056] Header information is encoded 314 into each extra information 306, 308, 310, where the header information succinctly describes the type, location, and length of extra data 316 included in each padding block 306, 308, 310. Remaining partition and relocation information, not included in the padding blocks 306, 308, 310 is encoded 128 into a special section within the randomizable program file, such as the extra section 224 of the randomizable program file 214 described above and with respect to Figure 2.

[0057] At times it may be beneficial to split relocation information across multiple randomization units. In embodiments where the first extra data 306 includes a first portion of the first relocation information and a second extra data 308 includes a second portion of the first relocation information, the first extra data comprises a link to the second relocation information. Including a link within the first extra data that points to the second relocation information allows a dynamic linker to easily locate all information necessary to complete relocation of the first extra data.

[0058] In one embodiment, the first extra data 306 includes a first relocation information and the first relocation information includes all relocation information necessary to relocate the first one or more complete functions Fl, F2, L2. When relocation information necessary for relocation of the first one or more complete functions Fl, F2, L2 included in the first extra data 306 is stored in a different randomization unit, such as the second randomization unit 308, an additional page needs to be loaded when relocating the first one or more functions Fl, F2, L2. Loadingadditional pages when relocating a first randomization unit complicates and increases load time of the first randomization unit.

[0059] Figure 4 illustrates a pictorial representation 400 of an exemplary method for partitioning an original text segment 108 into a partitioned text segment 408, 412 incorporating aspects of the disclosed embodiments. The pictorial representation 400 illustrated in Figure 4 is similar to the exemplary pictorial diagram 136 described above and with reference to Figure 1, where like references indicate like elements. As will be discussed further below, the pictorial representation 400 illustrates methods for creating two different types of partitioned text segments 408, 412. The exemplary methods depicted in the pictorial diagram 400 are configured to reduce the randomizable program size by storing additional functions in one or more of the padding blocks 120, 122, 124.

[0060] In one embodiment the partitioned text segment 408 includes a complete function F5 be stored in the first extra data 402. Storing a completer function F5 in the extra data 402 allows additional flexibility when creating the randomization units and may provide additional size reduction of the randomizable program file.

[0061] Large functions, such as the exemplary function F6, may not fit in a single extra data 404. When this occurs, large function may still be moved into the extra data by splitting the large function across multiple extra data blocks and linking the first portion of the large function to the second portion of the large function with an unconditional jump instruction. This is illustrated in the exemplary pictorial diagram 400 where the first extra data 404 includes a first portion of a function F6 and a second extra data 406 includes a second portion of the function F6, and the first extra data 404 includes an unconditional jump instruction 410 configured to link the first portion of the function to the second portion of the function. Splitting large functions across multiple padding block provides additional flexibility for reducing the size of a randomizable program file, and including an unconditional jump instruction 410 provides a simple way to link to split function together.

[0062] Each randomization unit 112, 114, 116 in the plurality of randomization units 132 may all be the same size, where the size is a multiple of the system memory page size. Optionally, the size of each randomization unit in the plurality of randomization units 132 may be a different multiple of one or more system memory pages.

[0063] Figure 5 illustrates an exemplary method 500 for loading 502, randomizing, and running 504 a randomizable program file incorporating aspects of the disclosed embodiments. The exemplary method 500 is appropriate for executing a randomizable program file, such as the randomizable program file 214 described above, where the randomizable program file includes a plurality of randomization units, such as the plurality of randomization units illustrated in the partitioned text segments 118, 318, 408, 412 described above and with reference to Figures 1, 3 and 4. The exemplary method 500 protects against code reuse attacks by generating a random permutation at load time and randomly shuffling a plurality of randomization units in memory thereby making it difficult for an attacker to locate desired gadgets and instruction sequences once execution begins.

[0064] The exemplary method 500 is split into two sections, load time 502 and run time 504, and is configured to load and run a plurality of randomization units included in a program file. Each randomization unit in the plurality ofrandomization units includes one or more complete functions and has a size that is a multiple of the system memory page size. The exemplary method 500 is appropriate for loading and running any of the plurality of randomization units described above and included in the partitioned text segments 118, 318, 408, 412.

[0065] Load time 502 operations may be performed by a loader, such as by a loader that is part of a computer operating system. A loader is an operating system component responsible for placing programs and libraries into memory and preparing them for execution. Loading 506 of a binary program file or other file containing executable code, such as the above-described exemplary randomizable program file 214, involves copying or memory mapping the contents of binary program file, into memory and performing required preparatory tasks to ready the executable code for running.

[0066] Executable code that has been partitioned into a plurality of randomization units requires partitioning information and relocation information be included in the randomizable program file along with the plurality of randomization units to support loading and linking of the executable code in preparation for execution. In one embodiment, the required partitioning and relocation information may be extracted 508 from an extra section in the randomizable program file, such as the extra section 224 in the exemplary randomizable program file 214 described above.

[0067] Size reduction of the randomizable program file is achieved by including useful information in the extra data incorporated into extra data of each randomization unit. This useful information is extracted 510 from the extra data during load time 502. Any desired type of useful information may be extracted from the extra data, such as partitioning information and relocation information configured to support randomized loading of the plurality of randomization units.

[0068] A random permutation is computed 512 to be used when paging the randomization units into memory. Computing 512 different random permutations and shuffling, or reordering, the plurality of randomization units based on the random permutation makes it difficult for an attacker to locate desired gadgets or instruction sequences in the executing program, thereby making code reuse attacks, such as ROP and JOP attacks, difficult.

[0069] At runtime 504, when a page is loaded 514 into memory, the page is copied 516 or mapped into a randomized memory address based on the computed 512 random permutation. Relocations are then performed 518 based on the relocation information extracted 508, 510 during load time 502. The relocated code page may then be executed 520.

[0070] Figure 6 illustrates a block diagram of an exemplary computing system 600 appropriate for implementing the herein disclosed methods incorporating aspects of the disclosed embodiments. Included in the exemplary computing system 600 is a build system 602 configured to implement an exemplary method to partition executable code into randomization units, such as the exemplary method 100 described above, and to create a randomizable program file, such as the exemplary randomizable program file 214 described above and with reference to Figure 2. An exemplary execution platform 604 is included in the exemplary computing system 600 and is configured toload and execute a randomizable program file such as the randomizable program file 214 which may be created by the exemplary build system 602.

[0071] Any appropriate type of general or specific purpose computing apparatus may be advantageously employed as the build system 602. In one embodiment the build system 602 includes a set of computing devices, such as servers, workstations, or other appropriate computing apparatus, deployed in an on-premises data center or in a cloud configuration. Alternatively, smaller computing apparatus such as workstations or laptop computers configured with a software development environment may be advantageously employed as the build system 602. When desired, smaller portable computing apparatus, such as portable communications devices, tablets, etc, may also be configured with a build environment and used as the build system 602.

[0072] Including a compiler 606 and linker 608 in the build system 602 allows executable code to be generated from a source code or other type of software source information. In certain embodiments the compiler 606 and linker 608 may be configured to generate an executable code in an executable and linkable format file, such as the standardized .elf file format used in many conventional Linux based computing systems. Optionally, the generated executable code may be stored in any suitable linkable and executable binary file format. A Binary rewrite tool 610 may be included in the build system 602 to partition the executable code generated by the compiler 606 and linker 608 into randomization units and create a randomizable program file, such as the randomizable program file 214, that includes a plurality of randomization units, a symbol table, and other information associated with the executable code. As described above, an extra section may be included to provide partitioning and relocation information describing how the executable code is partitioned into the randomization units.

[0073] When creating a randomizable program file, the build environment 602 may implement any of the methods for partitioning executable code into randomization units, such as the exemplary method 100 described above. In certain embodiments it may be beneficial to combine any or all of the compiler 606, linker 608 and rewrite tool 610 into a single software program. Optionally, it may be beneficial to create a linker 608 that performs both the linking and rewrite operations in a single application configured to convert compiled code directly into a randomizable program file.

[0074] The exemplary execution platform 604 may be any appropriate type of computing apparatus that may benefit from improved security against code-reuse attacks. For example, an appropriate execution platform 604 may include mobile devices such as smart phones, tablets, phablets, and laptops, or larger computing apparatus such as workstations, servers etc. An appropriate execution platform 604 may for example include a processor 612, a random-access memory (RAM) 614, and a non-volatile memory 616. In the illustrated embodiment the nonvolatile memory 616 includes a variety of software programs such as a loader 618 configured to load an executable code into a runtime memory, a dynamic linker 620 configured to perform relocations and fixup addresses in the executable module after it has been loaded, and an operating system 622 configured to manage software processes executing on the execution platform 604.When loading and executing a program file, the exemplary execution platform 604 is configured to perform a method for loading and executing a randomizable program file, such as the exemplary method 500 for loading and executing a randomizable program file described above and with reference to Figure 5. As discussed above, the exemplary execution platform 604 provides improved protection against code-reuse attacks by randomizing the location of executable code gadgets while minimizing loading and dynamic linking time through the use of a novel randomizable program file that incorporates improved randomization units configured to produce reduced file sizes and improve efficiency during program loading and execution.

[0075] Thus, while there have been shown, described, and pointed out, fundamental novel features of the invention as applied to the exemplary embodiments thereof, it will be understood that various omissions, substitutions and changes in the form and details of devices and methods illustrated, and in their operation, may be made by those skilled in the art without departing from the spirit and scope of the presently disclosed invention. Further, it is expressly intended that all combinations of those elements, which perform substantially the same function in substantially the same way to achieve the same results, are within the scope of the invention. Moreover, it should be recognized that structures and / or elements shown and / or described in connection with any disclosed form or embodiment of the invention may be incorporated in any other disclosed or described or suggested form or embodiment as a general matter of design choice. It is the intention, therefore, to be limited only as indicated by the scope of the claims appended hereto.

Claims

CLAIMS1. A method (100) for partitioning an executable code, wherein the executable code comprises a plurality of functions, the method (100) comprising:partitioning (126) the executable code into a plurality of randomization units wherein a unit size of individual randomization units in the plurality of randomization units is a multiple of a system memory page size, and wherein the partitioning (126) comprises:copying (104) one or more complete functions (Fl, F2, L2) from the plurality of functions into a first randomization unit in the plurality of randomization units; andpadding (128) the first randomization unit with a first extra data, wherein the first extra data comprises a no-operation data, and a size of the first extra data is configured to form a size of the first randomization unit that is a multiple of the system memory page size.

2. The method (100) according to claim 1, further comprising replacing (312) at least a portion of the first extra data with one or more of a partitioning information and a relocation information.

3. The method (100) according any one of the preceding claims, wherein the first extra data comprises a first relocation information and the first relocation information comprises all relocation information necessary to relocate the first one or more complete functions (Fl, F2, L2).

4. The method (100) according any one of the preceding claims, wherein the first extra data comprises a first portion of the first relocation information and a second randomization unit comprises a second extra data, and the second extra data comprises a second portion of the first relocation information and the first extra data comprises a link to the second relocation information.

5. The method (100) according any one of the preceding claims, wherein the first extra data comprises a complete function (F5).

6. The method (100) according any one of the preceding claims, wherein the first extra data comprises a first portion of a split function and a second extra data comprises a second portion of the split function, and the first extra data comprises an unconditional jump instruction (410) configured to link the first portion of the split function to the second portion of the split function.

7. The method (100) according any one of the preceding claims, wherein the size of each randomization unit in the plurality of randomization units is a preconfigured multiple of the memory page size.

8. The method (100) according any one of the preceding claims, wherein one or more functions in the plurality of functions comprises a literal pool.

9. The method (100) according to any one of the preceding claims, further comprising generating (230) a randomizable program file, wherein the randomizable program file comprises the plurality of one of morerandomization units and an extra section wherein the extra section comprises one or more of a partitioning information and a relocation information.

10. A method (500) for loading (502) and executing (504) a randomizable program file, wherein the randomizable program file comprises: a plurality of randomization units, and each randomization unit in the plurality of randomization units comprises: one or more complete function; an extra data; and a randomization unit size that is a multiple of a system memory page size,the method (500) comprising:loading (506) the randomizable program file;extracting (510) useful information from the extra data;computing (512) a random permutation;loading (514) a page into memory;copying (516) the page into a randomized memory address based on the computed random permutation; andexecuting (520) code from the page.

11. The method according to claim 10, wherein the extra data comprises one or more of a partitioning information and a relocation information, and the performing (518) relocation of the page is based at least in part on the partitioning information and the relocation information.

12. An apparatus (604) configured to load and execute a randomizable program file, wherein the randomizable program file comprises: a plurality of randomization units and each randomization unit in the plurality of randomization units comprises: one or more complete functions; an extra data; and a randomization unit size that is a multiple of a system memory page size, and the apparatus (604) comprises a processor (612), a random-access memory (614), and a program memory (616),wherein the program memory (616) comprises non-transitory program instructions that when executed by the processor (612) cause the processor (612) to perform the method (500) according to any one of claims 10 or 11.

13. The apparatus (604) according to claim 12, wherein the extra data comprises one or more of a partitioning information and a relocation information pertaining to the one or more complete functions.

Images