SYSTEM AND METHOD FOR EXECUTING AN ENCRYPTED BINARY FROM A MEMORY POOL

• US 20120260102A1
• Filed: 04/08/2011
• Published: 10/11/2012
• Est. Priority Date: 04/08/2011
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Zaks, Ganna, Betouin, Pierre, Farrugia, Augustin J., Lerouge, Julien, McLachlan, Jon, Myles, Gideon M., Tessier, Cédric
• Granted Patent: US 8,756,434 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits

Abstract

Disclosed herein are systems, methods, and non-transitory computer-readable storage media for executing encrypted computer code. A system configured to practice the method receives a request to execute encrypted computer code. In response to the request, the system identifies a portion of the encrypted computer code for execution and decrypts the portion to yield decrypted computer code. Then the system stores the decrypted computer code in a pool of memory and executes the decrypted computer code from the pool of memory. The system can store the decrypted computer code in the pool of memory based on a randomization algorithm so that identical executions of the encrypted computer code result in selections of different available memory locations within the pool of memory. Related portions can be stored non-consecutively in the pool of memory. The pool of memory can store different portions of decrypted computer code over time.

Claims

1. A method of executing computer code, the method comprising:

receiving a request to execute the computer code;

in response to the request, identifying a portion of the computer code for execution;

decrypting the portion to yield decrypted computer code;

storing the decrypted computer code in a pool of memory; and

executing, via a processor of a computing device, the decrypted computer code from the pool of memory.

2. The method of claim 1, wherein storing the decrypted computer code in the pool of memory is based on a randomization algorithm such that identical executions of the computer code result in selections of different available memory locations within the pool of memory.

3. The method of claim 1, wherein storing the decrypted computer code in the pool of memory is based on a randomization algorithm such that during a single execution of the computer code that calls the portion multiple times, the decrypted computer code is stored in different memory locations within the pool of memory over time.

4. The method of claim 1, wherein decrypting the portion is performed on demand.

5. The method of claim 1, wherein related portions are stored in the pool of memory non-consecutively.

6. The method of claim 1, wherein the pool of memory stores different portions of decrypted computer code over time.

7. The method of claim 1, wherein the computer code is part of a software package that includes encrypted and unencrypted code.

8. The method of claim 1, further comprising patching relative references in the computer code based on a location of the decrypted computer code in the pool of memory.

9. A system for executing computer code, the system comprising:

a processor;

a first module configured to control the processor to receive a request to run executable computer code;

a second module configured to control the processor to determine whether the executable computer code is encrypted;

a third module configured to control the processor to identify a portion of the computer code for execution if the executable computer code is encrypted;

a fourth module configured to control the processor to decrypt the portion to yield decrypted computer code;

a fifth module configured to control the processor to store the decrypted computer code in a pool of memory; and

a sixth module configured to control the processor to execute the decrypted computer code from the pool of memory.

10. The system of claim 9, wherein the portion is smaller than the computer code.

11. The system of claim 9, wherein the computer code is sliced into portions, and wherein the first module is further configured to control the processor to select one of the portions.

12. The system of claim 11, wherein the portion is part of a plurality of statically sized portions.

13. The system of claim 11, wherein the portion is part of a plurality of dynamically sized portions.

14. The system of claim 13, wherein a size for each respective portion of the plurality of dynamically sized portions is determined based on an analysis of each respective portion.

15. The system of claim 11, wherein the computer code is compressed before encryption, such that decrypted computer code is larger than the portion of the computer code.

16. A compiler for compiling code, the compiler comprising:

a processor;

a first module configured to control the processor to receive unencrypted code;

a second module configured to control the processor, as part of a compilation process yielding a compiled binary, to divide the unencrypted code into slices and encrypt at least one of the slices;

a third module configured to control the processor to embed a unpacking mechanism in the compiled binary, wherein during execution of the compiled binary the unpacking mechanism decrypts an encrypted slice on demand to yield a decrypted slice and stores the decrypted slice in a pool of memory for execution; and

a fourth module configured to control the processor to provide the compiled binary including the unpacking mechanism.

17. The compiler of claim 16, wherein the unpacking mechanism comprises a runtime dispatcher configured to decrypt the portion and store the decrypted computer code in the pool of memory during runtime of the compiled binary.

18. The compiler of claim 17, wherein the runtime dispatcher is further configured to evict unused portions from the pool of memory.

19. A non-transitory computer-readable storage medium storing instructions which, when executed by a computing device, cause the computing device to perform steps comprising:

identifying a portion of encrypted computer code for execution;

decrypting the portion to yield decrypted computer code;

temporarily storing the decrypted computer code in a pool of memory designated for decrypted computer code;

executing the decrypted computer code from the pool of memory; and

evicting the decrypted computer code from the pool of memory when the decrypted computer code is no longer needed.

20. The non-transitory computer-readable storage medium of claim 19, wherein a runtime dispatcher decrypts the portion and temporarily stores the decrypted computer code in the pool of memory.

21. The non-transitory computer-readable storage medium of claim 20, wherein the runtime dispatcher further patches a relative offset in the portion to yield a patched relative offset, such that the patched relative offset is properly executable with respect to remaining portions of the encrypted computer code.

22. The non-transitory computer-readable storage medium of claim 21, wherein the runtime dispatcher patches the relative offset based on preprocessed and separately stored information describing the relative offset.

23. The non-transitory computer-readable storage medium of claim 22, wherein the information describing the relative offset is scrambled before encrypting the encrypted computer code.

24. The non-transitory computer-readable storage medium of claim 20, further comprising computing a loading order of portions of the encrypted computer code based on compile time information.

25. The non-transitory computer-readable storage medium of claim 24, wherein the runtime dispatcher decrypts the portion and temporarily stores the decrypted computer code in the pool of memory based on the loading order.