Binary Obfuscation via Compile-Time Kernel Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern operating systems face significant vulnerabilities due to their widespread use and lack of physical or logical separation in cloud environments, making them susceptible to attacks through reverse engineering and exploitation, particularly in virtualized and embedded systems where attackers can leverage virtualization and supply chain manipulation to target identical hardware configurations.
Innovation Solution
A system and method for obfuscating binary codes by randomizing kernel code locations and memory, using techniques such as static binary rewriting, basic block reordering, instruction substitution, and page table randomization, which creates unique and diverse versions of operating systems without altering functionality, thereby undermining exploitability and fungibility assumptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If identical operating system binaries are deployed across multiple devices to reduce manufacturing costs and improve consistency, then ease of manufacture and system reliability are improved, but security is worsened because attackers can reverse engineer one device and exploit identical vulnerabilities across all devices
Solution Approach 1:
The patent applies parameter changes by modifying binary parameters at compile-time to generate diverse versions of the operating system. Specifically, it changes code relocation parameters, data relocation parameters, and link map parameters to create binaries with different memory layouts and symbol addresses, while maintaining functional equivalence. This resolves the contradiction by allowing mass production of functionally identical systems while introducing parameter diversity that prevents exploit reuse across devices.
Solution Approach 2:
The patent segments the binary modification process into distinct compile-time transformations: code relocation, data relocation, and link map generation. Each segment operates independently to transform the original binary into a diversified version. This segmentation allows the system to maintain manufacturing efficiency while introducing multiple layers of binary diversity that undermine attacker attempts to reuse exploits across identical-looking systems.
2Object-affected harmful factors
If operating system binaries are customized for each device to improve security through diversity, then security is improved, but device complexity and manufacturing difficulty increase
Solution Approach 1:
The patent applies preliminary action by performing all binary diversification transformations during the compile-time phase, before the operating system is deployed to devices. The compiler generates diversified binaries with randomized memory layouts, relocated code and data segments, and modified link maps in advance. This preliminary action eliminates the need for complex runtime modifications or device-specific customization processes, resolving the contradiction by achieving security diversity through automated compile-time processing rather than device-level complexity.
3Object-affected harmful factors
If binary obfuscation techniques are applied to randomize code locations and memory layouts, then exploitability is reduced, but difficulty of detecting and measuring system state increases
Solution Approach 1:
The patent applies parameter changes by systematically modifying binary parameters including code relocation addresses, data relocation addresses, and link map symbol resolutions. These parameter changes create non-predictable shifts in code locations and memory layouts, making it extremely difficult for attackers to perform static analysis or create exploits that target specific memory addresses. The obfuscation maintains functional correctness while dramatically increasing the difficulty of detecting and measuring system state, thereby reducing exploit productivity.
4Object-affected harmful factors
If kernel diversity is increased to create trillions of combinations for resistance against attacks, then security is improved, but runtime performance overhead increases
Solution Approach 1:
The patent applies preliminary action by completing all kernel diversification transformations during compile-time, generating finalized diversified binaries with fixed but randomized memory layouts and symbol resolutions. The diversified kernel is built and linked in advance with all relocation and address resolution completed before deployment. This preliminary action ensures that runtime performance is not degraded by diversification overhead, as the runtime system executes the already-diversified binary without needing to perform additional randomization or transformation operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for obfuscating binary codes are disclosed. In one embodiment, the system for obfuscating binary codes comprises one or more processors. The one or more processors may be configured to receive a binary file. The one or more processor may further be configured to obfuscate the binary file. The obfuscation may be based on rewriting the binary file and generating a second binary-randomized binary file. The binary file and the second binary-randomized binary file are functionally equivalent. The obfuscation may be based on randomizing the binary file at a load time, without changing functionality of the binary file.