On-Demand Code Decryption Integrity via Compensation Area
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the context of on-demand code decryption, existing techniques face challenges in maintaining code integrity due to modifications during execution, which can lead to false positives in integrity checks, and fail to prevent tampering while allowing for runtime code substitution.
Innovation Solution
A system and method that utilize a compensation area through XOR operations with dummy code to maintain consistent checksums, enabling the detection of tampering while allowing runtime code substitution without interfering with relocation instructions, by populating the on-demand code decryption area with runtime code and compensating for changes in the dummy code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If checksums are used to verify code integrity in on-demand code decryption, then code tampering can be detected, but false positives occur due to code modifications during execution
Solution Approach 1:
The code is divided into decryptable areas and non-decryptable areas. Checksum instructions are segmented to operate only on non-decryptable areas, avoiding the integrity verification problem in decryptable areas where code modifications occur during execution.
Solution Approach 2:
A mask is introduced as an intermediary to selectively prevent checksum instructions from accessing certain areas of the code. The mask distinguishes between decryptable areas (where modifications are expected) and non-decryptable areas (where integrity must be maintained), allowing checksums to verify only the appropriate portions.
2Object-affected harmful factors
If code is decrypted just prior to execution, then static analysis attacks are mitigated, but code integrity monitoring becomes more difficult
Solution Approach 1:
The code is segmented into decryptable and non-decryptable areas, allowing integrity monitoring to focus only on non-decryptable areas while the decryptable areas remain protected from static analysis. This segmentation reduces the complexity of integrity monitoring by limiting the scope to areas that require verification.
Solution Approach 2:
The system uses self-modifying code that automatically updates the mask to reflect the current execution state. This self-service mechanism eliminates the need for external complexity in tracking which areas have been decrypted, as the code maintains its own integrity monitoring configuration.
3Adaptability or versatility
If runtime code substitution is allowed, then code flexibility is improved, but detecting tampering becomes more challenging
Solution Approach 1:
A mask serves as an intermediary that distinguishes between legitimate runtime code substitutions and malicious tampering. The mask is configured to allow modifications in decryptable areas while maintaining strict integrity checks in non-decryptable areas, enabling flexible code substitution where needed while preventing unauthorized changes.
Solution Approach 2:
Different integrity monitoring strategies are applied to different areas of the code. Decryptable areas allow runtime modifications with relaxed monitoring, while non-decryptable areas maintain strict checksum verification. This local differentiation enables runtime code substitution flexibility while maintaining tampering detection capability where critical.
Data Source
AI summary
A system and a method for monitoring the integrity of code are provided. Dummy code is provided in an on demand decryption area of an object file while runtime code is provided elsewhere (and may be in the same object file or another object file). A compensation area is also provided which is initially blank. During execution, checksums can be calculated based on the result of an exclusive or (XOR) operation between contents of the on demand code decryption area and a compensation area such as a compensation area. As the runtime code populates the on demand code decryption area with the runtime code (potentially with the exception of areas masked to maintain integrity of relocation instructions allowed to remain in the dummy code) the compensation area is populated with the result of an XOR operation between the dummy code and the runtime code. As a result, the checksums will be the same throughout execution as long as integrity of the code has not been compromised.