Reversible Runtime Instrumentation for Managed Code Execution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for modifying processor-level instructions in software programs require editing and recompiling source code, which is inefficient and can lead to issues like signature invalidation and complexity, especially when modifying running processes or binary files without altering disk contents.

Innovation Solution

The development of an instrumentation framework that allows for querying and transforming processor-level instructions in a software program's execution image without modifying the pre-execution image, using a high-level programming language to identify and alter functions or instructions dynamically during runtime, enabling reversible transformations without restarting the program.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If source code is edited and recompiled to modify processor-level instructions, then program functionality can be changed, but the process becomes complex and time-consuming

Engineering Contradiction:

Improveease of modifying program instructionsVSAvoidtime required for editing and recompiling

Core Design Contradiction:

Ease of manufactureVSLoss of time

Solution Approach 1:

The patent creates a copy of the original program instructions in memory, allowing modifications to be applied to this copy rather than the original source code. This enables instruction modification without the need to edit and recompile source code, significantly reducing the time and complexity involved in changing program functionality.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The patent introduces an intermediary layer between the original program and its execution, consisting of copied instructions in memory that can be modified. This intermediary copy acts as a buffer, allowing changes to be made without directly altering the original source code or requiring recompilation, thus simplifying the modification process.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If binary files are modified on disk to change program behavior, then permanent changes are achieved, but signature validation fails and security is compromised

Engineering Contradiction:

Improveability to modify program behaviorVSAvoidsignature validation integrity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent separates the program into two distinct segments: the original binary file stored on disk with its intact signature, and a copied version loaded into memory that can be modified. This segmentation allows the original file to maintain its signature validation while the in-memory copy can be adapted to change program behavior without compromising security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent creates an in-memory copy of the original program instructions, allowing modifications to be applied to this copy without altering the original binary file on disk. This ensures that signature validation remains intact while still enabling program behavior changes through the modified in-memory version.

Inventive Principle:

Principle #26Copying

3Duration of action of moving object

If instructions are modified while the program is running, then dynamic adaptation is achieved, but system stability may be compromised

Engineering Contradiction:

Improveruntime modification capabilityVSAvoidexecution stability

Core Design Contradiction:

Duration of action of moving objectVSStability of the object's composition

Solution Approach 1:

The patent performs the instruction copying action in advance, before any modifications are made. By creating a complete copy of the original instructions in memory before altering them, the system ensures that the modification process does not disrupt ongoing execution, maintaining stability while enabling dynamic adaptation.

Inventive Principle:

Principle #10Preliminary action

4Ease of manufacture

If source code editing is used to modify instructions, then permanent changes are made, but the process lacks reversibility

Engineering Contradiction:

Improvesimplicity of modification processVSAvoidreversibility of changes

Core Design Contradiction:

Ease of manufactureVSEase of repair

Solution Approach 1:

The patent creates a copy of the original instructions in memory, preserving the original as a reference. This copying mechanism inherently provides reversibility, as the original instructions can be restored by simply discarding the modified copy and reloading the original, without requiring any complex undo mechanisms or version control systems.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS8732674B1Revertable managed execution image instrumentation

Publication Date: 2014.05.20 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A target program is instrumented during execution by using statements in high-level programming languages, without restarting the target and without modifying the compiled binary of the target on disk. The target and the analysis program modifying it may each include managed code. The target program is presented by an instrumentation API as a queryable database, rather than a mere sequence of processor-level instructions. An instrumentation context for the target program's execution image is obtained, with identifications of functions, individual instructions, and other instrumentable items that satisfy criteria specified in a query. Functions and low-level instructions may be identified as satisfying the query regardless of whether they have executed yet. High-level statements transform query-satisfying items in the target's execution image, by appending code, injecting a fault, replacing an individual instruction, or replacing an individual operand. Instrumentation transformations may be reverted without restarting execution and without reverting to the pre-execution image.