ANALYSIS AND CONTROL OF CODE FLOW AND DATA FLOW

• US 20180211046A1
• Filed: 01/26/2017
• Published: 07/26/2018
• Est. Priority Date: 01/26/2017
• Status: Active Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Muttik, Igor G., Sahita, Ravi L.
• Application Number:
  US15/416,934
• Publication Number:
  US 20180211046A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly
• CPC Class Codes: G06F 9/30058 Conditional branch instructions

Abstract

Technologies are provided in embodiments to analyze and control execution flow. At least some embodiments include decompiling object code of a software program on an endpoint to identify one or more branch instructions, receiving a list of one or more modifications associated with the object code, and modifying the object code based on the list and the identified one or more branch instructions to create new object code. The list of one or more modifications is based, at least in part, on telemetry data related to an execution of corresponding object code on at least one other endpoint. In more specific embodiments, a branch instruction of the one or more branch instructions is identified based, at least in part, on an absence of an instruction in the object code that validates the branch instruction.

Claims

1. At least one machine readable storage medium comprising code, wherein the code, when executed by at least one processor, cause the at least one processor to:

decompile object code of a software program on an endpoint to identify one or more branch instructions;

receive a list of one or more modifications associated with the object code, wherein the list of one or more modifications is based, at least in part, on telemetry data related to an execution of corresponding object code on at least one other endpoint; and

modify the object code based on the list and the identified one or more branch instructions to create new object code.

2. The at least one machine readable storage medium of claim 1, wherein the one or more modifications in the list are based, in part, on other telemetry data related to an execution of the object code on the endpoint.

3. The at least one machine readable storage medium of claim 1, wherein the code, when executed by the at least one processor, further causes the at least one processor to:

cause the new object code to be loaded for execution.

4. The at least one machine readable storage medium of claim 1, wherein a branch instruction of the one or more branch instructions is identified based, at least in part, on an absence of an instruction in the object code that validates the branch instruction.

5. The at least one machine readable storage medium of claim 1, wherein the code, when executed by the at least one processor, further causes the at least one processor to:

add an instruction to a first location in the object code to validate a branch instruction, wherein the first location is indicated in the list.

6. The at least one machine readable storage medium of claim 1, wherein the code, when executed by the at least one processor, further causes the at least one processor to:

remove an instruction that validates a branch instruction at a second location in the object code, wherein the second location is indicated in the list.

7. The at least one machine readable storage medium of claim 1, wherein the telemetry data identifies one or more locations in the corresponding object code where one or more branch instructions were executed, respectively, during the execution on the other endpoint.

8. The at least one machine readable storage medium of claim 1, wherein the code, when executed by the at least one processor, further causes the at least one processor to:

collect local telemetry data from one or more sources on the endpoint, wherein the local telemetry data is related to the new object code executing on the endpoint; and

communicate at least some of the local telemetry data to a server.

9. The at least one machine readable storage medium of claim 1, wherein the one or more sources of local telemetry data include at least one of a processor trace mechanism and a central processing unit (CPU) last branch record.

10. The at least one machine readable storage medium of claim 1, wherein the code, when executed by the at least one processor, causes the at least one processor to:

receive an updated list of one or more other modifications; and

dynamically modify the new object code according to the updated list, wherein the updated list of one or more other modifications is based, at least in part, on other telemetry data.

11. The at least one machine readable storage medium of claim 10, wherein dynamically modifying the new object code is to include:

rendering a portion of the new object code non-executable;

performing the one or more other modifications of the updated list to the non-executable portion of the new object code; and

subsequent to performing the one or more other modifications, rendering the non-executable portion of the new object code executable.

12. The at least one machine readable storage medium of claim 11, wherein the performing the one or more other modifications to the non-executable portion of the new object code includes using one of binary translation or binary rewriting to dynamically perform the one or more other modifications.

13. An apparatus for controlling code flow, comprising:

at least one processor; and

logic coupled to the processor for execution by the processor, the logic to;

decompile object code of a software program on the apparatus to identify one or more branch instructions;

receive a list of one or more modifications associated with the object code, wherein the list of one or more modifications is based, at least in part, on telemetry data related to an execution of corresponding object code on at least one other endpoint; and

modify the object code based on the list and the identified one or more branch instructions to create new object code.

14. The apparatus of claim 13, wherein the one or more modifications in the list are based, in part, on other telemetry data related to an execution of the object code on the endpoint.

15. The apparatus of claim 13, wherein the logic is further to:

add an instruction to a first location in the object code to validate a branch instruction, wherein the first location is indicated in the list.

16. The apparatus of claim 13, wherein the logic is further to:

remove an instruction that validates a branch instruction at a second location in the object code, wherein the second location is indicated in the list.

17. The apparatus of claim 13, wherein the logic is further to:

collect local telemetry data from one or more sources on the apparatus, wherein the local telemetry data is related to the new object code executing on the at least one processor; and

communicate at least some of the local telemetry data to a server.

18. A method, comprising:

decompiling object code of a software program on an endpoint to identify one or more branch instructions;

receiving a list of one or more modifications associated with the object code, wherein the list of one or more modifications is based, at least in part, on telemetry data related to an execution of corresponding object code on at least one other endpoint; and

modifying the object code based on the list and the identified one or more branch instructions to create new object code.

19. The method of claim 18, further comprising:

adding an instruction to a first location in the object code to validate a branch instruction, wherein the first location is indicated in the list.

20. A system for analyzing and controlling code flow, the system comprising:

a server comprising first logic to;

receive telemetry data related to first object code executing on a first endpoint;

identify one or more locations in the first object code corresponding to one or more branch instructions;

generate a list of one or more modifications to be made to second object code on a second endpoint based, at least in part, on the identified one or more locations; and

the second endpoint communicatively coupled to the server, the second endpoint to;

receive the list of one or more modifications from the server; and

create new object code by modifying the second object code based, at least in part, on the list of one or more modifications.

21. The system of claim 20, wherein at least one of the one or more modifications in the list indicate an instruction to be added to the second object code to validate a branch instruction.

22. The system of claim 20, wherein the second endpoint is further to:

collect local telemetry data from one or more sources on the second endpoint, wherein the local telemetry data is related to the new object code executing on the second endpoint; and

communicate at least some of the local telemetry data to a server.

23. The system of claim 21, wherein the first logic of the server is further to:

aggregate the local telemetry data with other telemetry data related to one or more other instances of corresponding object code executing on one or more other endpoints, respectively; and

generate an updated list of one or more modifications to be made to the new object code.

24. The system of claim 20, wherein the second endpoint is further to:

receive an updated list of one or more modifications from the server while the new object code is executing on the second endpoint; and

dynamically modify the new object code according to the updated list of one or more modifications to create updated object code.

25. At least one machine readable storage medium comprising executable instructions, wherein the instructions, when executed by at least one processor, cause the at least one processor to:

pause execution of a program on a computing system;

determine verification metadata associated with the program, the verification metadata indicated in a metadata sub-page region associated with a primary sub-page region;

determine actual metadata associated with the execution of the program; and

generate a notification based on the verification metadata not corresponding to the actual metadata.