Binary Obfuscation via Compile-Time Kernel Randomization

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Modern operating systems face significant vulnerabilities due to their widespread use and lack of physical or logical separation in cloud environments, making them susceptible to attacks through reverse engineering and exploitation, particularly in virtualized and embedded systems where attackers can leverage virtualization and supply chain manipulation to target identical hardware configurations.

Innovation Solution

A system and method for obfuscating binary codes by randomizing kernel code locations and memory, using techniques such as static binary rewriting, basic block reordering, instruction substitution, and page table randomization, which creates unique and diverse versions of operating systems without altering functionality, thereby undermining exploitability and fungibility assumptions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If identical operating system binaries are deployed across multiple devices to reduce manufacturing costs and improve consistency, then ease of manufacture and system reliability are improved, but security is worsened because attackers can reverse engineer one device and exploit identical vulnerabilities across all devices

Engineering Contradiction:
Improvemanufacturing costVSAvoidsecurity vulnerability
Core Design Contradiction:
Ease of manufactureVSObject-affected harmful factors

Solution Approach 1:

The patent applies parameter changes by modifying binary parameters at compile-time to generate diverse versions of the operating system. Specifically, it changes code relocation parameters, data relocation parameters, and link map parameters to create binaries with different memory layouts and symbol addresses, while maintaining functional equivalence. This resolves the contradiction by allowing mass production of functionally identical systems while introducing parameter diversity that prevents exploit reuse across devices.

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

The patent segments the binary modification process into distinct compile-time transformations: code relocation, data relocation, and link map generation. Each segment operates independently to transform the original binary into a diversified version. This segmentation allows the system to maintain manufacturing efficiency while introducing multiple layers of binary diversity that undermine attacker attempts to reuse exploits across identical-looking systems.

Inventive Principle:
Principle #1Segmentation

2Object-affected harmful factors

If operating system binaries are customized for each device to improve security through diversity, then security is improved, but device complexity and manufacturing difficulty increase

Engineering Contradiction:
Improvesecurity vulnerabilityVSAvoidbinary configuration
Core Design Contradiction:
Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by performing all binary diversification transformations during the compile-time phase, before the operating system is deployed to devices. The compiler generates diversified binaries with randomized memory layouts, relocated code and data segments, and modified link maps in advance. This preliminary action eliminates the need for complex runtime modifications or device-specific customization processes, resolving the contradiction by achieving security diversity through automated compile-time processing rather than device-level complexity.

Inventive Principle:
Principle #10Preliminary action

3Object-affected harmful factors

If binary obfuscation techniques are applied to randomize code locations and memory layouts, then exploitability is reduced, but difficulty of detecting and measuring system state increases

Engineering Contradiction:
Improveexploit productivityVSAvoidsystem state analysis
Core Design Contradiction:
Object-affected harmful factorsVSDifficulty of detecting and measuring

Solution Approach 1:

The patent applies parameter changes by systematically modifying binary parameters including code relocation addresses, data relocation addresses, and link map symbol resolutions. These parameter changes create non-predictable shifts in code locations and memory layouts, making it extremely difficult for attackers to perform static analysis or create exploits that target specific memory addresses. The obfuscation maintains functional correctness while dramatically increasing the difficulty of detecting and measuring system state, thereby reducing exploit productivity.

Inventive Principle:
Principle #35Parameter changes

4Object-affected harmful factors

If kernel diversity is increased to create trillions of combinations for resistance against attacks, then security is improved, but runtime performance overhead increases

Engineering Contradiction:
Improveattack effectivenessVSAvoidruntime performance
Core Design Contradiction:
Object-affected harmful factorsVSUse of energy by moving object

Solution Approach 1:

The patent applies preliminary action by completing all kernel diversification transformations during compile-time, generating finalized diversified binaries with fixed but randomized memory layouts and symbol resolutions. The diversified kernel is built and linked in advance with all relocation and address resolution completed before deployment. This preliminary action ensures that runtime performance is not degraded by diversification overhead, as the runtime system executes the already-diversified binary without needing to perform additional randomization or transformation operations.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3281104B1System and method of obfuscation through binary and memory diversity
Publication Date: 2024.01.24 RUNSAFE SECURITY INC
  • EP3281104B1 patent drawingFigure 1
  • EP3281104B1 patent drawingFigure 2
  • EP3281104B1 patent drawingFigure 3

AI summary

A system and method for obfuscating binary codes are disclosed. In one embodiment, the system for obfuscating binary codes comprises one or more processors. The one or more processors may be configured to receive a binary file. The one or more processor may further be configured to obfuscate the binary file. The obfuscation may be based on rewriting the binary file and generating a second binary-randomized binary file. The binary file and the second binary-randomized binary file are functionally equivalent. The obfuscation may be based on randomizing the binary file at a load time, without changing functionality of the binary file.