Piracy prevention using unique module translation

• US 8,028,340 B2
• Filed: 09/01/2009
• Issued: 09/27/2011
• Est. Priority Date: 05/04/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sebes, E. John, Naik, Dilip, Bhargava, Rishi
• Primary Examiner(s): Smithers; Matthew
• Application Number:
  US12/551,673
• Publication Number:
  US 20090320140A1
• Time in Patent Office: 756 Days
• Field of Search: 713/164
• US Class Current: 726/26
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code

Abstract

A method for providing solidified software in a computing environment includes creating a new reference for a function in a function table; copying an address of the function and associating the address with the new reference; replacing the address associated with an old reference of the function with a dummy address; and substituting each old reference in normal code with the new reference, where injected code is not able to execute in the computing environment. The function table entries can be further randomized by reordering the entries, introducing intermediate mappings, or providing non-operative entries. Alternatively, all or part of the code of the function can be copied and moved to a different storage location and associated with the new reference. The copied code can be further randomized by the insertion of dummy code, utilizing reverse peephole techniques, varying the size of the copied portion, or interleaving non-operative code.

Claims

1. A method comprising:

creating a new reference for a function in a function table of a computer;

copying an original address of the function;

associating the original address to the new reference in the function table;

associating an original reference to a dummy address in the function table; and

interleaving non-operating entries into the function table.

2. The method of claim 1, further comprising:

receiving injected code; and

directing the injected code to the dummy address.

3. The method of claim 2, wherein the injected code comprises a set of instructions that do not have authorization to be executed on the computer.

4. The method of claim 1, further comprising:

randomizing entries in the function table for a plurality of functions associated with new references.

5. The method of claim 1, further comprising:

providing an intermediate mapping for entries in the function table for a plurality of functions associated with the new reference.

6. The method of claim 1, further comprising:

scanning original code for the function; and

substituting a reference to the function in the original code with the new reference.

7. The method of claim 1, further comprising:

copying original code for the function, wherein the original code for the function is stored at a first storage location of the computer; and

placing the copied code in a second storage location of the computer.

8. The method of claim 7, wherein copying the original code comprises copying only a portion of the original code.

9. The method of claim 7, further comprising:

replacing the original code for the function with dummy code provided in the first storage location of the computer.

10. Logic encoded in one or more tangible non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

creating a new reference for a function in a function table of a computer;

copying an original address of the function;

associating the original address to the new reference in the function table;

associating an original reference to a dummy address in the function table;

providing an intermediate mapping for entries in the function table for a plurality of functions associated with new references; and

randomizing entries in the function table for the plurality of functions associated with the new references.

11. The logic of claim 10 being further operable to perform operations, comprising:

receiving injected code; and

directing the injected code to the dummy address, wherein the injected code comprises a set of instructions that do not have authorization to be executed on the computer.

12. The logic of claim 10 being further operable to perform operations, comprising:

scanning original code for the function; and

substituting a reference to the function in the original code with the new reference.

13. The logic of claim 10 being further operable to perform operations, comprising:

copying original code for the function, wherein the original code for the function is stored at a first storage location of the computer; and

placing the copied code in a second storage location of the computer.

14. An apparatus comprising:

a processor;

a memory; and

an interface operable to communicate with the memory, wherein the interface is configured to;

create a new reference for a function in a function table of a computer;

copy an original address of the function;

associate the original address to the new reference in the function table;

associate an original reference to a dummy address in the function table; and

interleave non-operating entries into the function table.

15. The apparatus of claim 14, wherein the interface is further configured to:

receive injected code; and

direct the injected code to the dummy address.

16. The apparatus of claim 15, wherein the injected code comprises a set of instructions that do not have authorization to be executed on the computer.

17. The apparatus of claim 14, wherein the interface is further configured to:

randomize entries in the function table for a plurality of functions associated with new references.