Post-Build Stack Recording for Runtime Foreign Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems face attacks through foreign code execution, which existing methods struggle to detect and prevent, especially when modifications occur in runtime data rather than stored code.
Innovation Solution
A post-build utility records and stores stack and call tree information within an executable program, allowing an authentication module to perform reliable stack walking and verification of return addresses against the intended call sequence, thereby detecting and preventing foreign code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static module authentication via hashing is used to verify stored code integrity, then modification detection capability is improved, but runtime attack detection capability deteriorates
Solution Approach 1:
The patent applies preliminary action by recording the call tree and stack information during the build phase before runtime execution. This pre-recorded execution path information is stored in the executable and later used during runtime to detect attacks by comparing actual execution against the expected call sequence, enabling runtime attack detection without modifying the stored code
Solution Approach 2:
The patent uses copying by creating a duplicate representation of the program's execution structure (call tree) during the build phase. This copied execution path information is embedded in the executable and used at runtime to verify that actual execution follows the expected sequence, allowing detection of runtime attacks without altering the original program code
2Productivity
If stack walking is performed without recorded call tree information, then execution speed is improved, but foreign code detection capability deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-recording the legitimate call tree information during the build phase and embedding it in the executable. During runtime, this pre-recorded information enables rapid verification of execution paths without requiring complex analysis, thus maintaining execution speed while enabling foreign code detection through comparison of actual vs. expected call sequences
3Reliability
If call tree information is recorded and stored within the executable, then foreign code detection capability is improved, but executable size deteriorates
Solution Approach 1:
The patent uses copying by embedding a condensed representation of the call tree information within the executable's data section. This copied execution path data is a compact structure that records the legitimate sequence of function calls, enabling foreign code detection while minimizing the increase in executable size compared to storing complete debugging information
Data Source
AI summary
A mechanism is provided, where a post-build utility is used to store stack and call tree information within a section of an executable program or separate file. The stack information aids an authentication module during the execution of the program in walking up a stack in order to obtain return addresses on the stack. In one aspect of the invention, by comparing the return address sequence to the call tree sequence, which specifies the allowed function call sequence of the program, a determination can be made whether the program is executing (as evidenced by the stack) the way it should be executing (as required by the call tree). If the call tree sequence differs from the return address sequence, a suspicion is raised that a hacker is attempting to jump from foreign code into sensitive code of the program by changing the function calling sequence.