Piracy Prevention Using Unique Module Translation

• US 20090320140A1
• Filed: 09/01/2009
• Published: 12/24/2009
• Est. Priority Date: 05/04/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sebes, E. John, Naik, Dilip, Bhargava, Rishi
• Granted Patent: US 8,028,340 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code

Abstract

A method for providing solidified software in a computing environment includes creating a new reference for a function in a function table; copying an address of the function and associating the address with the new reference; replacing the address associated with an old reference of the function with a dummy address; and substituting each old reference in normal code with the new reference, where injected code is not able to execute in the computing environment. The function table entries can be further randomized by reordering the entries, introducing intermediate mappings, or providing non-operative entries. Alternatively, all or part of the code of the function can be copied and moved to a different storage location and associated with the new reference. The copied code can be further randomized by the insertion of dummy code, utilizing reverse peephole techniques, varying the size of the copied portion, or interleaving non-operative code.

Claims

1-26. -26. (canceled)

27. A method comprising:

creating a new reference for a function in a function table of a computer;

copying an original address of the function;

associating the original address to the new reference in the function table; and

associating an original reference to a dummy address in the function table.

28. The method of claim 27, further comprising:

receiving injected code; and

directing the injected code to the dummy address.

29. The method of claim 28, wherein the injected code comprises a set of instructions that do not have authorization to be executed on the computer.

30. The method of claim 27, further comprising:

randomizing entries in the function table for a plurality of functions associated with new references.

31. The method of claim 27, further comprising:

interleaving non-operating entries into the function table.

32. The method of claim 27, further comprising:

providing an intermediate mapping for entries in the function table for a plurality of functions associated with the new reference.

33. The method of claim 27, further comprising:

scanning original code for the function; and

substituting a reference to the function in the original code with the new reference.

34. The method of claim 27, further comprising:

copying original code for the function, wherein the original code for the function is stored at a first storage location of the computer; and

placing the copied code in a second storage location of the computer.

35. The method of claim 34, wherein copying the original code comprises copying only a portion of the original code.

36. The method of claim 34, further comprising:

replacing the original code for the function with dummy code provided in the first storage location of the computer.

37. Logic encoded in one or more tangible media that includes code for execution and when executed by a processor is operable to perform operations comprising:

creating a new reference for a function in a function table of a computer;

copying an original address of the function;

associating the original address to the new reference in the function table; and

associating an original reference to a dummy address in the function table.

38. The logic of claim 37 being further operable to perform operations, comprising:

receiving injected code; and

directing the injected code to the dummy address, wherein the injected code comprises a set of instructions that do not have authorization to be executed on the computer.

39. The logic of claim 37 being further operable to perform operations, comprising:

providing an intermediate mapping for entries in the function table for a plurality of functions associated with the new reference.

40. The logic of claim 37 being further operable to perform operations, comprising:

scanning original code for the function; and

substituting a reference to the function in the original code with the new reference.

41. The logic of claim 37 being further operable to perform operations, comprising:

copying original code for the function, wherein the original code for the function is stored at a first storage location of the computer; and

placing the copied code in a second storage location of the computer.

42. An apparatus comprising:

an interface operable to communicate with a memory, wherein the interface is configured to;

create a new reference for a function in a function table of a computer;

copy an original address of the function;

associate the original address to the new reference in the function table; and

associate an original reference to a dummy address in the function table.

43. The apparatus of claim 42, wherein the interface is further configured to:

receive injected code; and

direct the injected code to the dummy address.

44. The apparatus of claim 43, wherein the injected code comprises a set of instructions that do not have authorization to be executed on the computer.

45. The apparatus of claim 42, wherein the interface is further configured to:

randomize entries in the function table for a plurality of functions associated with new references.

46. The apparatus of claim 42, wherein the interface is further configured to:

interleave non-operating entries into the function table.