Thread-Local Code Replication for Anti-Patching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting computer program code, especially security-sensitive functions, are vulnerable to dynamic analysis and patching by attackers, who can exploit decrypted code locations during runtime to circumvent security measures.
Innovation Solution
The solution involves dynamically allocating thread-local memory for each thread, where the code is decrypted and executed, making it difficult for attackers to find and modify the decrypted code, as memory addresses are unique and changeable, and each thread has its own memory location, thereby complicating dynamic analysis and patching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If code is decrypted in place during runtime, then decryption is simple and fast, but attackers can easily find and analyze the decrypted code locations
Solution Approach 1:
The patent extracts the decrypted code from its original fixed memory location and places it in dynamically allocated memory spaces. Instead of decrypting code in place at a known address, the system allocates memory dynamically using heap allocation functions, causing the decrypted code to reside at unpredictable memory addresses that change between program executions, thereby preventing attackers from easily locating and analyzing the decrypted code.
Solution Approach 2:
The patent introduces dynamic allocation of memory spaces for decrypted code, making the memory addresses unpredictable and changing between program runs. This dynamic behavior contrasts with static memory allocation, forcing attackers to continuously adapt their analysis tools to locate the moving target of decrypted code, significantly increasing the difficulty of reverse engineering.
2Quantity of substance
If multiple threads share the same code memory space, then memory usage is efficient, but attackers can more easily identify and patch security-sensitive code
Solution Approach 1:
The patent segments the shared code memory space by creating thread-local copies of decrypted code. Each thread receives its own separate memory allocation containing the necessary code portions, isolating them from other threads. This segmentation prevents attackers from patching a single location to affect all threads, as each thread operates with its own isolated code copy in unpredictable memory locations.
3Object-affected harmful factors
If code is encrypted to protect against static analysis, then static analysis is blocked, but dynamic analysis during runtime can still locate decrypted code
Solution Approach 1:
The patent enhances protection against dynamic analysis by making the decrypted code's memory location dynamic and unpredictable. Instead of decrypting code at a fixed address that can be traced and monitored, the system uses dynamic memory allocation to place decrypted code at varying addresses between program executions. This forces dynamic analysis tools to continuously adapt to new memory locations, significantly increasing the complexity and resource requirements for successful attacks.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is disclosed a method of executing computer program code comprising a code portion, the method comprising: loading said computer program code into a program memory space as first executable code such as a memory-mapped executable file; instantiating a plurality of threads for execution of said computer program code; dynamically allocating a thread memory space for each thread; for each thread, reproducing said code portion into the corresponding dynamically allocated thread memory space; and during execution of each thread, executing the reproduced code portion in said dynamically allocated thread memory space instead of executing the code portion in the first executable code file. Also disclosed are a computer system arranged to carry out the method, and a method of modifying an existing computer program to function in this way.