Program Instance Memory Reference Resolution for Binary Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Comparing two versions of a program loaded in main memory is challenging due to changes in memory references caused by different loading locations, making it difficult to determine if a program has been modified or infected with malware.
Innovation Solution
A method where a second instance of a program is loaded with a parameter that treats it as if it were loaded at the same memory location as the first instance, allowing for a fair comparison by resolving memory references accordingly, enabling binary comparisons without worrying about changed memory locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a program is loaded at different memory locations, then the program can be flexibly placed in memory, but the memory references change making comparison difficult
Solution Approach 1:
The patent introduces a memory reference resolution mechanism that acts as an intermediary between the loaded program and its actual memory location. When a program is loaded at a different memory location, the resolution mechanism translates the memory references in the loaded program to match the references of the original program, enabling accurate comparison despite different loading locations.
Solution Approach 2:
The patent changes the parameter of memory reference resolution by loading the program with a specific parameter that causes memory references to be resolved as if the program were loaded at the original starting memory location, rather than its actual loading location. This parameter change enables accurate program comparison.
2Reliability
If memory references are resolved based on actual loading location, then the program executes correctly at its loaded address, but comparison with the original program becomes inaccurate
Solution Approach 1:
The patent implements a dynamic memory reference resolution mechanism that can adapt its behavior based on the comparison task. The system dynamically adjusts the resolution approach to resolve references as if the program were loaded at the original location, enabling accurate comparison while maintaining the ability to execute at the actual loaded address when needed.
3Productivity
If the original program is compared byte-by-byte with the loaded program, then the comparison is simple and fast, but the comparison is inaccurate due to different memory locations
Solution Approach 1:
The patent performs preliminary memory reference resolution before the comparison operation. By pre-resolving all memory references in the loaded program to match the original program's reference scheme, the system enables subsequent simple and fast byte-by-byte comparison while ensuring accuracy, as the references have already been aligned.
Data Source
AI summary
Embodiments are directed to a computer-implemented method for determining whether a program has been modified. The method can include determining that a first instance of the program is loaded in main memory. The method can further include determining a starting memory location of the first instance of the program. A second instance of the program is loaded into main memory. The second instance of the program is loaded such that memory references in the second instance of the program are resolved as if the second instance were loaded at the starting memory location of the first instance of the program. The first instance of the program is compared with the second instance of the program.