Polymorphic Software Relocatable Image Randomization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware, particularly polymorphic software, poses a significant threat to computer systems by exploiting the static morphology of relocatable images, allowing it to intercept and manipulate functions and storage blocks, which existing technologies struggle to effectively counter.
Innovation Solution
The implementation of a system that randomizes the order of functions and storage blocks within relocatable images, generating randomized relocatable image information and map information, which frustrates malware by changing the known locations, thereby preventing pre-programmed jumps and control manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware exploits static morphology of relocatable images, then malware can intercept and manipulate functions and storage blocks, but system security deteriorates
Solution Approach 1:
The patent applies dynamics by randomizing the order of functions and storage blocks in relocatable images at runtime. Instead of using a fixed static morphology, the system dynamically reorders components so that malware's pre-programmed interception paths become invalid. The randomization is seeded with a unique identifier, ensuring consistent randomization for the same image while maintaining security across different executions.
Solution Approach 2:
The patent changes the parameter of spatial arrangement by randomizing the order of functions and storage blocks. This parameter change transforms the static morphology into a dynamic one, where the same functional components are positioned differently in memory. The randomization parameter is controlled through a seed value derived from unique identifiers, allowing reproducible randomization for debugging while maintaining security in production.
2Reliability
If the order of functions and storage blocks is randomized, then malware pre-programmed jumps are prevented, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing the randomized order of functions and storage blocks in a data structure before execution. The randomization is performed once during image loading or initialization, and the resulting ordered structure is cached for use during runtime. This eliminates the need for complex real-time randomization logic while maintaining the security benefits.
Solution Approach 2:
The patent uses copying by creating a randomized copy of the relocatable image structure. Instead of modifying the original static morphology, the system generates a randomized variant that preserves all functional relationships while changing spatial arrangements. The randomized structure is then used for execution, while the original remains available for reference and debugging purposes.
3Reliability
If randomization is applied to relocatable images, then static location dependencies are eliminated, but mapping and tracking difficulty increases
Solution Approach 1:
The patent applies feedback by maintaining a mapping data structure that tracks the randomized positions of functions and storage blocks. This mapping serves as feedback information that allows the system to resolve forward references correctly despite randomization. The mapping is updated and maintained throughout execution, enabling accurate tracking of component locations without exposing the randomization mechanism to malware analysis tools.
Solution Approach 2:
The patent uses an intermediary mapping structure as a mediator between the randomized memory layout and the functional relationships. This intermediary layer translates between the randomized physical locations and the logical function identifiers, allowing the system to maintain correct references without leaking location information. The mapping acts as a secret that resolves references internally while keeping the randomization opaque to external observers.
Data Source
AI summary
Systems and methods for defeating malware with polymorphic software are described. The system generates randomized relocatable image information by randomizing a plurality of function information that is included in relocatable image information. The plurality of function information includes a first function information. The first function information includes a first location that is used to enter the first function information. The randomizing further includes updating instruction information in the randomized relocatable image information. Updating the instruction information further includes updating relative address information utilized to enter the first function via the first location based on a new location of the first function in the randomized relocatable image information. The system further applies a base address to the randomized relocatable image information to generate randomized executable image information, loads the randomized executable image information into the memory, and executes the randomized executable image information.