Code Obfuscation via Dynamic Memory Layout Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems connected to the Internet are vulnerable to malware attacks that exploit uniform resource locations, allowing malicious software to infect and control operating systems and applications, leading to disruptive and self-propagating threats like the Slammer virus.
Innovation Solution
An obfuscation system that retrieves executable code, selects and applies various obfuscation techniques such as rearranging code blocks, encrypting code, and inserting minefield functions to randomize resource locations, making it difficult for malware to infect the code by ensuring each installation or execution instance has a unique arrangement, thereby preventing uniform exploitation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware exploits uniform resource locations in operating systems and applications, then the malware can reliably infect and control the systems, but the systems become vulnerable to widespread attacks
Solution Approach 1:
The patent applies asymmetry by randomizing the location of code blocks and data structures in memory during program execution. Each execution instance has a unique memory layout, making it impossible for malware to rely on fixed addresses. The obfuscation system modifies the executable code to create different memory arrangements for each run, thereby preventing uniform exploitation by malware while maintaining system functionality.
Solution Approach 2:
The patent implements dynamics by making the memory layout changeable rather than fixed. The obfuscation system dynamically repositions code blocks, functions, and data structures based on random seeds or execution context. This dynamic reconfiguration ensures that even if malware succeeds in infecting one instance, it cannot reliably target subsequent instances with the same exploit vector.
2Ease of manufacture
If the same version of a program is installed uniformly across all systems, then installation and maintenance are simplified, but all systems become identical targets for malware
Solution Approach 1:
The patent maintains installation consistency at the surface level while introducing asymmetry in the actual execution environment. The obfuscation system ensures that all systems receive the same program package, but during execution, it randomizes memory layouts, function locations, and data structure positions. This allows uniform installation for ease of deployment while creating unique execution characteristics that prevent uniform malware exploitation.
3Object-affected harmful factors
If obfuscation techniques are applied to computer code, then malware finds it difficult to locate and exploit resources, but the code complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the executable code into separate code blocks and functions that can be independently positioned and obfuscated. The obfuscation system segments the code into manageable units, randomizes their locations, and maintains mapping information to ensure correct execution. This segmentation allows complex obfuscation without overwhelming the entire codebase, making the process more manageable while effectively preventing malware from predicting resource locations.
Data Source
AI summary
A method and system for obfuscating computer code of a program to protect it from the adverse effects of malware is provided. The obfuscation system retrieves an executable form of the computer code. The obfuscation system then selects various obfuscation techniques to use in obfuscating the computer code. The obfuscation system applies the selected obfuscation techniques to the computer code. The obfuscation system then causes the obfuscated computer code to execute.