Method for runtime code integrity validation using code block checksums

• US 20030188231A1
• Filed: 04/01/2002
• Published: 10/02/2003
• Est. Priority Date: 04/01/2002
• Status: Active Grant

• Current Assignee: Pace Anti-Piracy, Inc.
• Original Assignee: Pace Anti-Piracy, Inc.
• Inventors: Cronce, Paul A.
• Granted Patent: US 6,880,149 B2
• Time in Patent Office: Days
• US Class Current: 714/52
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs

Abstract

The present invention provides a method and system for runtime code integrity validation. The method and system include providing a software tool for processing a software program, as well as instructions on how to modify the software program for submission to the tool. The modified software program executable generated for submission to the tool includes checksum information for use by the tool. The tool uses the checksum information to compute checksums on blocks specified by the checksum information, and stores the computed checksums in locations specified by the checksum information. Next, the tool strips the checksum information from the executable. The resulting executable code is delivered as a protected software application that generates a new checksum at runtime and compares it with the computed checksum, and determines that the software program has been modified if the checksums fail to match.

Claims

What. What is claimed is:

cm 1. A method for performing runtime checksum validation of a software program, the method comprising the steps of;

(a) providing a software tool as well as instructions on how to modify the software program to submit to the tool, wherein executable code is generated from the modified software program that includes checksum information for the tool to use when processing the software program;

(b) in response to the executable code being submitted to the tool, the tool calculates at least one checksum, embeds the checksum in the executable code in a location indicated by the checksum information, and strips the checksum information from the executable code; and

(c) delivering the executable code as a protected software program, wherein during execution, the protected software application generates a new checksum and determines that the software application has been modified if the new checksum fails to match the embedded checksum.

2. The method of claim 1 further includes the step of storing the checksum in a checksum data structure, the location of which is specified in the checksum information.

5. The method of claim 2 further including the step of detecting overlapping code block definitions and checksum data structure locations such that for any data structure located within a defined block, the checksum results for the block associated with the data structure are computed and stored prior to the checksum calculation for the containing block, thus allowing chaining of checksum calculations for multiple blocks.

6. The method of claim 5 further including the generation of an error message when chaining of computations forms a closed loop, and thus cannot be completed.

3. The method of claim 1 wherein step (a) further includes the step of providing in the checksum information the location of a block and the location for the checksum for each block of the protected software program for which a checksum is required.

4. The method of claim 3 further includes the step of providing a checksum algorithm selector in the checksum information

7. The method of claim 1 further including the step of providing source code for one or more checksum algorithms to the application developer for including in the application for the purpose of computing the checksums at runtime, whereby the developer may obfuscate the checksum algorithm code by making modifications to the code, such that the compiled algorithm code cannot be easily located by a pattern-matching search.

8. The method of claim 1 further including the step of selecting checksum algorithms that allow computation of the checksum for a code block using random sized sequential segments from the code block being validated, such that the work of computing the checksum may be spread over a time period using only small portions of CPU processing power, thereby making detection of the checksum process more difficult.

9. A method for runtime code integrity validation of an application program using code block checksums, the method comprising the steps of:

(a) detecting a first set of exported symbols in a software application defining a start and end of one or more defined code blocks to be validated;

(b) detecting a second set of exported symbols in the software application defining the location of a checksum data structure for each defined code block where computed checksums are to be stored;

(c) computing a checksum of the defined blocks and storing the computed checksum in the defined data structures;

(d) stripping from the software application the detected sets of exported symbols to obfuscate the defined blocks and data structures; and

(e) storing the software application with the obfuscated code blocks and data structures, such that the application can verify the integrity of the code blocks during runtime by computing a runtime checksum for the code blocks and comparing the runtime checksum with the checksum stored in the data structures.

10. The method of claim 9 wherein step (c) further includes the step of:

(i) selecting from a plurality of supported checksum algorithms using a selector stored within the data structure.

11. The method of claim 9 further including the step of detecting the exported symbols by using a defined naming convention.

12. The method of claim 9 further including the step of detecting overlapping code block definitions and data structure locations such that for any data structure located within a defined block, the checksum results for the block associated with the data structure are computed and stored prior to the checksum calculation for the containing block, thus allowing chaining of checksum calculations for multiple blocks.

13. The method of claim 12 further including the generation of an error message when chaining of computations forms a closed loop, and thus cannot be completed successfully

14. The method of claim 9 further including the step of providing source code for one or more checksum algorithms to the application developer for including in the application for the purpose of computing the checksums at runtime, whereby the developer may obfuscate the checksum algorithm code by making modifications to the code, such that the compiled algorithm code cannot be easily located by a pattern-matching search.

15. The method of claim 9 further including the step of selecting checksum algorithms that allow computation of the checksum for a code block using random sized sequential segments from the code block being validated, such that the work of computing the checksum may be spread over a time period using only small portions of CPU processing power, thereby making detection of the checksum process more difficult.

16. A method for runtime code integrity validation of an application program using code block checksums, the method comprising the steps of:

(a) detecting an exported symbol in a software application defining the location of a checksum data structure where the computed checksum is to be stored;

(b) computing the checksum of the application program, skipping over the data structure, and storing the results in the data structure;

(c) stripping from the application program the detected exported symbol to obfuscate the location of the data structure; and

(d) generating a software application executable object with the obfuscated data structure such that the application code can verify the integrity of the code during runtime by computing the checksum of the application not including the data structure and comparing the result with the result stored in the data structure.

17. The method of claim 16 wherein step (b) further includes the step of:

(i) selecting from a plurality of supported checksum algorithms using a selector stored within the data structure.

18. The method of claim 16 further including the step of providing source code for one or more checksum algorithms to the application developer for including in the application for the purpose of computing the checksums at runtime, whereby the developer may obfuscate the checksum algorithm code by making modifications to the code, such that the compiled algorithm code cannot be easily located by a pattern-matching search.

19. The method of claim 16 further including the step of selecting checksum algorithms that allow piecewise incremental computation of the checksum for a code block using random sized sequential segments from the code block being validated, such that the work of computing the checksum may be spread over a time period using only small portions of CPU cycles, thereby making detection of the checksum process more difficult.

20. A method for runtime code integrity validation of an application program using code block checksums, the method comprising the steps of:

(a) selecting one or more code blocks of the application program to be validated, and indicating the start and end of the selected code blocks using exported symbols;

(b) defining a checksum data structure for each defined block and indicating its location using exported symbols;

(c) incorporating one or more checksum algorithms within the code for computing checksums at runtime; and

(d) incorporating code to request the computation of the checksum at runtime for each defined block, and to compare the results of the runtime checksum calculation with the value stored in the related checksum data structure;

(e) incorporating code to discourage use of the application program when the checksums do not validate; and

(f) processing the application program code using a tool that performs the functions of;

(i) locating the defined code blocks using the exported symbols,

(ii) computing the checksum of each block and storing the results in the data structure for each block located using the exported symbols, and

(iii) stripping the exported symbols from the application code to obfuscate the location of the blocks and data structures.

21. The method of claim 20 further including the step of modifying the checksum algorithm code to obfuscate the compiled code so that the algorithm cannot easily be located by pattern matching.

22. The method of claim 20 further including the step of selecting from a plurality of checksum algorithms such that both the processing step checksum calculation and the runtime calculation uses the same checksum algorithm by storing a algorithm selector in the checksum data structure, and using this selector during both the processing step and at runtime to execute the same selected checksum algorithm for the defined block.

23. The method of claim 20 further including the step of selecting checksum algorithms that allow piecewise incremental computation of the checksum for a code block using random sized sequential segments from the code block being validated, such that the work of computing the checksum may be spread over a time period using only small portions of CPU cycles, thereby making detection of the checksum process more difficult.

24. The method of claim 23 further including the step of computing sequential portions of the checksum for any given block at selected time periods during execution of the application program, thereby increasing the difficulty of locating the validation code.

25. The method of claim 23 further including the step of computing sequential portions of the checksum for any given block from multiple locations within the application program, thereby increasing the difficulty of locating the validation code.

26. The method of claim 20 further including the step of delaying the action taken after detecting a checksum validation failure, thereby obfuscating the code invalidating the checksum by the time elapsed and volume of code executed between the invalidation and the visible occurrence of the resulting action taken.

27. A method for determining if protected software is modified, the method comprising the steps of

(a) instructing a software developer to modify an executable version of the software to be protected by performing the steps of:

(i) exporting predefined checksum related data,

(ii) adding code to compute a new checksum at runtime,

(iii) adding code to compare the computed runtime checksum with a checksum stored in the executable,

(iv) determining that the protected software has been modified if the checksums do not compare; and

(b) wrapping the executable in a anti-piracy software wrapper, and performing the steps of;

(i) automatically detecting the exported checksum related data,

(ii) computing a checksum of the executable,

(iii) embedding the checksum in the executable; and

(iv) removing the exported checksum related symbols from the executable.

28. The method of claim 27 further including the step of:

in response to determining that the software has been modified, taking an action at a time delayed from a time of detection.

29. The method of claim 27 wherein step (a) further includes the step of:

exporting a starting and ending address of a program block and a checksum data structure to receive the computed checksum of the program block as the checksum-related data.

30. The method of claim 29 further including the step of including in the checksum data structure a checksum algorithm selector wherein one of a plurality of checksum algorithms may be selected for a given block.

31. The method of claim 29 further including the step of including more than one start and ending address and checksum data structures.

32. A computer-readable medium containing program instructions for runtime code integrity validation of an application program using code block checksums, the instructions for:

(a) detecting a first set of exported symbols in a software application defining a start of one or more defined code blocks to be validated;

(b) detecting a second set of exported symbols in the software application defining the end of a defined code block and the location of a checksum data structure for each defined code block where computed checksums are to be stored;

(c) computing a checksum of the defined blocks and storing the computed checksum in the defined data structures;

(d) stripping from the software application the detected sets of exported symbols to obfuscate the defined blocks and data structures;

(e) storing the software application with the obfuscated code blocks and data structures, such that the application can verify the integrity of the code blocks during runtime by computing a runtime checksum for the code blocks and comparing the runtime checksum with the checksum stored in the data structures.

33. The computer-readable medium of claim 32 wherein instruction (c) further includes the instruction of:

(i) selecting from a plurality of supported checksum algorithms using a selector stored within the data structure.

34. The computer-readable medium of claim 32 further including the instruction of detecting the exported symbols by using a defined naming convention.

35. The computer-readable medium of claim 32 further including the instruction of providing source code for one or more checksum algorithms to the application developer for including in the application for the purpose of computing the checksums at runtime, whereby the developer may obfuscate the checksum algorithm code by making modifications to the code, such that the compiled algorithm code cannot be easily located by pattern matching.

36. The computer-readable medium of claim 32 further including the instruction of selecting checksum algorithms that allow piecewise incremental computation of the checksum for a code block using random sized sequential segments from the code block being validated, such that the work of computing the checksum may be spread over a time period using only small portions of CPU cycles, thereby making detection of the checksum process more difficult.