Internal Debugger Kernel Control Against External Code Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security mechanisms are easily bypassed by skilled hackers, allowing unauthorized access, modification, and exploitation of software programs, posing a threat to revenue and intellectual property rights.
Innovation Solution
Implementing an internal debugger application that utilizes kernel resources to set break-points in the code of a software program, controlling its execution path and preventing external debugger applications from analyzing the code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional software security mechanisms (encryption, passwords, license checks) are used to protect software programs, then basic unauthorized access is blocked, but skilled hackers can easily bypass these mechanisms using memory lifting tools and debugging tools to capture data from memory locations and reverse engineer the code
Solution Approach 1:
The patent introduces an intermediary component (debugger application or security module) that acts as a mediator between the software code and external debugging tools. This intermediary monitors and controls access to code execution, detecting when external debuggers attempt to attach and blocking their ability to analyze code, thereby preventing hackers from using debugging tools to reverse engineer the software
Solution Approach 2:
The patent implements preliminary anti-action by proactively detecting and blocking external debugger attachments before hackers can use them to analyze the code. The security mechanism preemptively identifies attempts to attach debugging tools and prevents the debugger from gaining access to code execution, countering the hacker's intended action before it can be executed
2Reliability
If encryption is applied to software code to hinder hackers' ability to understand and overcome license restrictions, then code comprehension is blocked, but encryption can be breached by skilled hackers or crackers
Solution Approach 1:
The patent replaces traditional mechanical encryption methods with a software-based security mechanism that uses debugger detection and blocking. Instead of relying solely on cryptographic encryption that can be brute-forced, the system uses runtime monitoring and control mechanisms that detect and prevent debugger attachment, providing a different layer of protection that doesn't depend on breaking encryption
3Reliability
If memory protection mechanisms are implemented to prevent data capture from memory locations, then data security is improved, but powerful debugging tools can still monitor file systems and duplicate entire operating systems to access protected data
Solution Approach 1:
The patent introduces an intermediary security mechanism that operates at the debugger attachment level rather than just memory protection. This intermediary monitors for external debugger attempts to attach to the process and blocks them before they can access memory or file system monitoring capabilities, preventing hackers from using tools to capture data from memory locations or monitor file systems
Data Source
AI summary
A method for blocking external debugger application from analysing code of software program installed on computing device. The method including initializing software program including an application program and an internal debugger application. The software program, upon initialization thereof, instructs internal debugger application to load application program in internal debugger application. The internal debugger application is configured to utilize kernel resources of an operating system of the computing device. The method includes executing internal debugger application to set one or more break-points in code of application program to define execution path for code of application program, executing application program as per defined execution path for code thereof, stopping execution of code of application program upon reaching any of one or more break-points therein, and handing control to internal debugger application to provide an address for next instruction to be executed in defined execution path for code of application program.