SYSTEMS AND METHODS FOR DEFEATING MALWARE WITH POLYMORPHIC SOFTWARE

• US 20150040223A1
• Filed: 07/31/2013
• Published: 02/05/2015
• Est. Priority Date: 07/31/2013
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Tobin, John Patrick Edgar
• Granted Patent: US 9,104,869 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly
• CPC Class Codes: G06F 9/449 Object-oriented method invocation or resolution
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods for defeating malware with polymorphic software are described. The system generates randomized relocatable image information by randomizing a plurality of function information that is included in relocatable image information. The plurality of function information includes a first function information. The first function information includes a first location that is used to enter the first function information. The randomizing further includes updating instruction information in the randomized relocatable image information. Updating the instruction information further includes updating relative address information utilized to enter the first function via the first location based on a new location of the first function in the randomized relocatable image information. The system further applies a base address to the randomized relocatable image information to generate randomized executable image information, loads the randomized executable image information into the memory, and executes the randomized executable image information.

Claims

1. A system comprising:

at least one processor, and memory including instruction information that, when executed by the at least one processor, cause the system to;

generate randomized relocatable image information, the generation of the randomized relocatable image information includes a randomization of a plurality of function information that is included in relocatable image information to generate the randomized relocatable image information, the plurality of function information includes a first function information, the first function information includes a first location that is used to enter the first function information, the generation of the randomized relocatable image information further includes an update of relative address information that is included in instruction information that is included in the randomized relocatable image information, the relative address information is utilized to enter the first function via the first location based on a new location of the first function in the randomized relocatable image information;

apply a base address to the randomized relocatable image information to generate randomized executable image information;

load the randomized executable image information into the memory; and

execute the randomized executable image information.

2. The system of claim 1, wherein the at least one processor updates the relative address information that is utilized to access a first storage location in the randomized relocatable image information.

3. The system of claim 1, further comprising:

a linker to link module information to generate the relocatable image information and a part of map information.

4. The system of claim 3, wherein the map information is further generated by assembling assembly information to generate the module information and a part of the map information.

5. The system of claim 1, the at least one processor further configured to analyze the relocatable image information to generate map information.

6. The system of claim 5, wherein the at least one processor analyzes the relocatable image information to generate the map information.

7. The system of claim 6, wherein the disassembler stores the map information to persistent storage and retrieves the map information from persistent storage to optimize a subsequent analysis of the relocatable image information.

8. The system of claim 3, wherein the map information includes directive information to disable the randomizing parts of the relocatable image information that are identified by the directive information.

9. The system of claim 5, wherein the at least one processor analyzes the relocatable image information in a “

.NET Framework”

to generate the map information.

10. A method including:

generating randomized relocatable image information, the generating including;

randomizing a plurality of function information that is included in relocatable image information to generate the randomized relocatable image information, the plurality of function information including a first function information, the first function information including a first location that is used to enter the first function information;

updating instruction information in the randomized relocatable image information, the updating the instruction information including updating relative address information utilized to enter the first function via the first location based on a new location of the first function in the randomized relocatable image information;

applying a base address to the randomized relocatable image information to generate randomized executable image information;

loading the randomized executable image information into the memory; and

executing the randomized executable image information.

11. The method of claim 10, wherein the updating instruction information in the randomized relocatable image information includes updating the relative address information that is utilized to access a first storage location in the randomized relocatable image information.

12. The method of claim 10, wherein the relocatable image information is generated by linking module information;

and wherein the linking module information generates a part of map information that is associated with the relocatable image information.

13. The method of claim 12, wherein the map information is further generated by assembling assembly information to generate the module information and a part of the map information.

14. The method of claim 10, further comprising analyzing the relocatable image information to generate map information.

15. The method of claim 14, wherein the analyzing includes utilizing a disassembler to analyze the relocatable image information to generate the map information.

16. The method of claim 15, wherein the analyzing further includes:

storing the map information to persistent storage; and

retrieving the map information from persistent storage to optimize a subsequent analysis of the relocatable image information.

17. The method of claim 12, wherein the map information includes directive information to disable randomization of parts of the relocatable image information.

18. The method of claim 14, wherein the analyzing the relocatable image information to generate the map information includes analyzing the relocatable image information in a “

.NET Framework.”

19. A non-transitory machine-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform the following actions:

generating randomized relocatable image information, the generating including;

randomizing a plurality of function information that is included in relocatable image information to generate the randomized relocatable image information, the plurality of function information including a first function information, the first function information including a first location that is used to enter the first function information;

updating instruction information in the randomized relocatable image information, the updating the instruction information including updating relative address information utilized to enter the first function via the first location based on a new location of the first function in the randomized relocatable image information;

applying a base address to the randomized relocatable image information to generate randomized executable image information;

loading the randomized executable image information into the memory; and

executing the randomized executable image information.

20. The non-transitory machine-readable medium of claim 19, wherein the updating instruction information in the randomized relocatable image information includes updating the relative address information that is utilized to access a first storage location in the randomized relocatable image information.