Software Code Integrity Check via Dynamic Jump Target Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-tampering techniques in software protection can be reversed-engineered by attackers, allowing them to modify software code despite integrity checks, as these methods are often identifiable through static analysis.
Innovation Solution
A method that inserts a first sequence of instructions in a selected basic block of the software code to compute an integrity check value and an index value, which indexes a jump instruction to a following basic block, making it difficult for attackers to predict the integrity check or jump target through static analysis, and applies this protection to a portion of the software code determined randomly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional integrity check methods are used (computing checksum and comparing with reference value), then the software can detect code modification, but the method can be easily identified and broken through static analysis by attackers
Solution Approach 1:
The patent changes the parameters of the integrity check by using the checksum value not to directly select the next instruction address, but to compute an index that selects from multiple candidate jump targets. This transformation obscures the relationship between the integrity check result and the actual control flow, making static analysis difficult while maintaining reliability.
Solution Approach 2:
The patent introduces an intermediary mechanism: instead of directly using the checksum to determine execution flow, it uses the checksum to compute an index value that selects from an array of candidate target addresses. This intermediary layer (the index computation and candidate array) hides the actual integrity verification logic from static analysis while preserving the reliability of the check.
2Ease of operation
If the jump instruction target is fixed and predictable, then the code execution flow is simple to analyze, but attackers can easily identify and modify the protected region boundaries
Solution Approach 1:
The patent makes the jump instruction target dynamic by computing the target address at runtime based on the integrity check result. The next instruction address is selected from multiple candidates stored in an array, with the selection index derived from the checksum. This dynamic behavior prevents attackers from statically identifying protected region boundaries while keeping the execution mechanism relatively simple.
3Ease of manufacture
If the integrity check uses a constant reference value, then the verification is straightforward, but attackers can identify the check location and patch the routine to always return valid values
Solution Approach 1:
The patent transforms the integrity check output from a direct comparison with a constant reference value into an index computation that selects from multiple candidate targets. The checksum is processed through additional operations (bit manipulation, modular arithmetic) to produce an index value, changing the parameter representation and making the check resistant to simple patching attempts.
Solution Approach 2:
The patent segments the jump target selection into multiple candidates stored in an array, where each candidate represents a possible next instruction address. The integrity check result selects one segment (candidate) from this divided set, making it difficult for attackers to identify and patch the specific protected location while maintaining implementation simplicity.
Data Source
AI summary
The present invention relates to a method of securing a compiled software code (SC) comprising computer code instructions organized in a plurality of basic blocks, said method generating a secure software code (SSC) and comprising the steps of: •determining (S1) by a processor a portion of the software code to be protected, •inserting (S2) by the processor in a selected basic block of the software code a first sequence of instructions which when executed at runtime: computes an integrity check value on said portion of the software code to be protected and computes an index value based on said computed integrity check value, •inserting (S3) by the processor in the selected basic block of the software code an indexed array of memory addresses in which the address, when executing the secure software code, of a following basic block to be executed after the selected basic block is indexed by said index value, •inserting (S4) by the processor at the end of the selected basic block of the software code a jump instruction to the address indexed in the array by said index value computed at runtime.