Runtime Application Stack Validation via Precomputed Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting and preventing attacks on application execution stacks, such as return-oriented programming (ROP) attacks, are inadequate, as they either impose additional costs, introduce compatibility issues, or fail to guarantee robustness against new attacks, and there is a need for automated and seamless stack validation to ensure runtime security without user intervention.
Innovation Solution
A computer-implemented method that disassembles executable binary code, generates validation tables for API and function calls, scans for stack setup and unwind instructions, creates an unwind table, and inserts a monitoring and validation hook to validate the runtime stack during execution, allowing for automatic detection of rule violations and implementation of default actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automated stack validation is implemented, then attack detection capability is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary disassembly of the executable binary code before execution to generate validation tables and unwind tables. This preliminary action creates the validation rules and stack frame expectations in advance, enabling automated runtime validation without adding complexity during execution. The validation logic is prepared beforehand but only activated when needed during runtime.
Solution Approach 2:
The patent introduces validation tables and unwind tables as intermediary data structures that mediate between the complex validation logic and the runtime execution. These tables store pre-computed validation rules and stack frame information, allowing the runtime validator to simply lookup and verify against stored data rather than performing complex analysis during execution, thus reducing runtime complexity.
2Reliability
If runtime stack validation is performed continuously, then security monitoring is improved, but execution performance deteriorates
Solution Approach 1:
The validation hook is triggered periodically or at specific events (such as function entry/exit points) rather than continuously monitoring every instruction. The system validates the stack at natural boundaries in the execution flow, maintaining security monitoring while minimizing performance impact by avoiding constant validation overhead during execution.
Solution Approach 2:
The validation mechanism uses the existing function call structure and stack operations to perform validation. By leveraging the natural entry and exit points of functions, the system allows the execution flow itself to drive the validation process rather than requiring separate validation instructions to be executed continuously, reducing the overhead burden.
3Reliability
If stack validation hooks are inserted in every function, then validation coverage is improved, but compatibility with existing tools deteriorates
Solution Approach 1:
The validation tables and unwind tables serve multiple functions: they provide validation rules for security monitoring, enable stack frame unwinding for debugging, and maintain compatibility with existing tooling by using standard binary formats. The same data structures support both security validation and existing development tools, reducing the need for separate compatibility layers.
Solution Approach 2:
The system changes the parameters of binary code analysis by working with disassembled instruction sequences and generating validation rules from existing function call patterns. Rather than modifying the executable format or introducing non-standard binary structures, the system analyzes and validates using standard parameters (instruction addresses, function names, stack offsets) that existing tools can understand and interpret.
Data Source
AI summary
In one aspect, a computer-implemented method for monitoring and validating execution of an executable binary code, includes the step of, prior to beginning execution of the executable binary code, disassembling the executable binary code, listing all of application programming interfaces (API) or function calls in the executable binary code, generating a validation table for a type of each of the APIs or each of the function calls, a location of each of the APIs or each of the function calls, and a return address of each of the APIs or each of the function calls in the executable binary code, and listing in the validation table the type of each of the APIs or each of the function calls.