Self-Modifying Executable Integrity via Memory Retargeting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to effectively verify the integrity of self-modifying executables after they have begun executing, as their dynamic state differs significantly from the pre-execution state, making it impossible to determine whether changes are due to malicious activity or normal operation.
Innovation Solution
A method is implemented where a hypervisor detects attempts by a self-modifying executable to access its data portion during execution and retargets these accesses to a separate memory space, maintaining the executable's static state for integrity measurement, by leveraging TLB desynchronization and page fault handling to ensure continuous verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If verification is performed on self-modifying executables after execution begins, then integrity measurement should be possible, but the dynamic state changes make verification useless
Solution Approach 1:
The patent segments the memory space into a first portion containing the static executable image and a second portion for dynamic data. By separating these functions, the executable code remains immutable and measurable while allowing dynamic operations in the data portion. The hypervisor enforces this segmentation to prevent self-modification of the code portion, enabling continuous integrity verification.
Solution Approach 2:
The hypervisor acts as an intermediary between the executable and the memory space. It intercepts and redirects data access attempts from the first portion to the second portion, preventing direct modification of the executable code. This intermediary mechanism enables both self-modifying execution behavior and static code verification to coexist.
2Adaptability or versatility
If the executable is allowed to modify its own data portion during execution, then dynamic operation is enabled, but integrity measurement becomes impossible
Solution Approach 1:
The patent divides memory into distinct segments: a read-only first portion for the executable image and a writable second portion for dynamic data. This segmentation allows the executable to modify data in the second portion while the first portion remains immutable and suitable for precise integrity measurement.
Solution Approach 2:
The patent extracts the data portion from the executable image and places it in a separate memory region. By taking out the modifiable data elements from the static code structure, the system enables dynamic operations without compromising the integrity measurability of the original executable image.
3Reliability
If data access retargeting is implemented, then integrity verification is maintained, but system complexity increases
Solution Approach 1:
The hypervisor serves as an intermediary that automatically handles data access retargeting. When the executable attempts to access or modify its code section, the hypervisor intercepts the request and redirects it to the appropriate data portion. This automated intermediary approach maintains integrity verification while minimizing the complexity burden on the system.
Solution Approach 2:
The system uses the existing page fault mechanism and memory management structures to automatically handle retargeting. When a protection violation occurs on the first portion, the system automatically redirects to the second portion without requiring complex external intervention, leveraging self-service mechanisms to reduce overall system complexity.
Data Source
AI summary
Trusted execution of a self-modifying executable is facilitated. An attempt to access a data portion of a self-modifying executable during execution of the self-modifying executable is detected. The self-modifying executable includes the data portion, for storing data to be accessed during execution of the self-modifying executable, and an instruction portion including instructions for execution of the self-modifying executable. The attempt to access the data portion is retargeted to a separate portion of memory space that is separate from another portion of memory space in which the self-modifying executable is loaded for execution. Meaningful measurability of the integrity of the self-modifying executable is thereby provided.