Binary Translation Randomization for Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to prevent exploit techniques that rely on code and data layouts, such as ASLR, are only partially effective and suffer from performance penalties and vulnerabilities like address leaks, which can be bypassed by attackers.
Innovation Solution
A binary translation and randomization system (BTRS) that modifies relocation metadata to randomly relocate instructions and segments, generating a unique execution order for each execution unit, thereby preventing attackers from exploiting known layouts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Address Space Layout Permutation (ASLP) is used to randomize code and data segments, then application security against exploits is improved, but performance overhead increases and address leaks can still occur
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing relocation metadata during the compilation phase, which captures all necessary relocation information before runtime. This allows the runtime system to quickly apply randomization without performing complex analysis during execution, thereby improving security while minimizing performance overhead.
Solution Approach 2:
The patent segments the binary into execution units with granular control over code and data sections. By dividing the binary into smaller executable units and applying randomization at this granular level, the system achieves better security coverage without proportionally increasing overhead, as each segment can be independently and efficiently processed.
2Reliability
If fine-grained randomization is applied to procedure bodies and data objects, then resistance to code-reuse attacks is improved, but binary complexity and processing requirements increase
Solution Approach 1:
The compilation phase performs preliminary analysis and generates detailed relocation metadata that captures control flow relationships and data dependencies. This pre-computation simplifies the runtime process, allowing fine-grained randomization to be applied without proportionally increasing runtime complexity or processing requirements.
Solution Approach 2:
The patent introduces relocation metadata as an intermediary structure that mediates between the original binary and the randomized execution. This metadata layer captures all necessary relocation information and control flow relationships, allowing the runtime system to apply complex transformations without directly manipulating the binary structure, thereby reducing operational complexity.
3Reliability
If code segments are relocated to random addresses, then protection against exploits relying on known layouts is improved, but address resolution complexity increases
Solution Approach 1:
The patent performs preliminary analysis during compilation to generate comprehensive relocation metadata that includes all address resolution information. This pre-computed metadata captures control flow targets, data references, and inter-procedural calls, allowing the runtime system to quickly resolve addresses without performing complex analysis during execution.
Solution Approach 2:
The relocation metadata acts as an intermediary that bridges the original binary structure and the randomized address space. It contains pre-computed relocation information that simplifies the address resolution process, allowing the runtime system to apply randomization while efficiently resolving all address references without proportionally increasing complexity.
4Reliability
If multiple randomization passes are applied, then brute-force attack resistance is improved, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary computation of relocation metadata during compilation, which enables multiple randomization passes to be applied efficiently at runtime. The pre-computed metadata structure allows for rapid application of multiple randomization layers without proportionally increasing processing time, as the heavy lifting is done during the compilation phase.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
In one embodiment, methods are described to provide a binary translation and randomization system. Relocation metadata is received, which comprises, for each of a plurality of execution units in an executable file, a mapping from the executable file into an address space range. For at least one of the plurality of execution units, the mapping is modified to replace instructions within the address space range with a relocated copy of the instructions at a randomly located address space range. An order of the plurality of execution units may thus be modified. An image is generated from the executable file using the relocation metadata, and an execution of the image is caused. The randomization may be carried out in two passes to provide executable files that are uniquely randomized for each computer and for each execution.