Executable Binary Code Insertion for Control Flow Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inadequate in protecting computer programs from malware attacks, particularly return-oriented programming exploits, as they fail to effectively monitor and secure the control flow of executable binary files without access to source code.
Innovation Solution
Modifying compiled executable binary files by inserting new software segments that monitor control flow integrity and prevent unauthorized modifications, allowing normal operation while preventing malware hijacking, using existing binary files without source code access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If branch auditing software is injected into source code to monitor control flow, then security against malware attacks is improved, but source code access is required which is not always available
Solution Approach 1:
The patent applies preliminary action by pre-compiling security monitoring code into the executable binary file during the software compilation process. This allows the binary file to contain embedded auditing capabilities that automatically monitor control flow without requiring later source code access or separate injection steps, thus resolving the contradiction between security protection and source code accessibility.
2Reliability
If executable binary files are modified to add security segments, then control flow monitoring capability is improved, but file structure complexity increases
Solution Approach 1:
The patent applies merging by combining the security monitoring code with the original executable code into a single integrated binary file. The compilation process merges the auditing functionality directly into the existing binary structure, allowing control flow monitoring capabilities to be added without creating separate complex file structures or requiring multiple independent components.
3Reliability
If new software segments are inserted into executable files, then malware protection capability is improved, but execution performance may deteriorate
Solution Approach 1:
The patent applies feedback by implementing monitoring mechanisms that observe control flow transitions and provide information about potential malware attacks. The embedded auditing code monitors program execution and can trigger protective actions when suspicious patterns are detected, enabling malware protection through intelligent monitoring rather than continuous intervention, thus minimizing performance impact while maintaining security.
Data Source
AI summary
An automated and processor agnostic method is described for modifying one or more executable binary files to insert one or more new software segments to modify the execution of the one or more executable binary files in at least certain circumstances. The modification takes into account the target microprocessor architecture of the one or more executable binary files which can be in the ELF format. In one embodiment, the new software segments are configured to add at least monitoring capabilities to monitor control flow integrity during execution of the one or more executable binary files.