Tracking a programs calling context using a hybrid code signature

• US 8,756,582 B2
• Filed: 08/22/2011
• Issued: 06/17/2014
• Est. Priority Date: 08/22/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Serrano, Mauricio J.
• Primary Examiner(s): Rutten, James D
• Application Number:
  US13/214,352
• Publication Number:
  US 20130054942A1
• Time in Patent Office: 1,030 Days
• Field of Search: None
• US Class Current: 717/128
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs

Abstract

A method for a hybrid code signature including executing, via a processor, an application, the executing comprising executing a root instruction of the application; profiling, via the processor, the executing of the application, the profiling comprising storing a reference signature; determining, via the processor, a working signature of instructions executed subsequent to the executing of the root instruction, the determining comprising implementing a hashing function of the instructions in response to storing the reference signature; tracking the updating of the working signature by storing a value in a counter; and updating continuously, via the processor, the working signature with the hashing function while at least the working signature does not match the reference signature.

Claims

1. A method for generating a hybrid code signature, the method comprising:

executing, via a processor, an application, the executing comprising executing a root instruction of the application;

profiling, via the processor, the executing of the application, the profiling comprising storing a reference signature determined from the root instruction;

determining, via the processor, a working signature of instructions executed subsequent to the executing of the root instruction, the determining comprising utilizing a CALL level and a hashing value of a return address in response to storing the reference signature;

tracking the updating of the working signature by storing a value in a counter indicative of the CALL level; and

updating continuously, via the processor, the working signature with a hashing function while the working signature at least does not match the reference signature;

wherein the hashing function includes a bit wise rotation of the working signature by a predetermined number of bits.

2. The method of claim 1, wherein the updating of the working signature further comprises determining additional auxiliary conditions for the executing application.

3. The method of claim 2, wherein the determining of the additional auxiliary conditions further comprises determining whether an address of the root instruction matches a predetermined address, whether a first value stored in a loop counter matches a second predetermined value, or whether the reference signature matches a hash value of at least one of Exclusive-OR'"'"'ing the address with the working signature or Exclusive-OR'"'"'ing the first value with the working signature.

4. The method of claim 1, wherein the updating of the working signature further comprising the executing of the application after the root instruction.

5. The method of claim 1, further comprising updating the working signature in response to executing a call instruction and a return instruction during the execution of the application.

6. The method of claim 1, further comprising updating the working signature in response to executing a branch instruction and resuming after the branch instruction during the execution of the application.

7. The method of claim 3, further comprising incrementing the value of the counter during the executing of the call instruction and decrementing the value of the counter during the executing of the return instruction.

8. The method of claim 1, further comprising initially storing the reference signature as the working signature in response to the executing of the root instruction.

9. The method of claim 1, wherein the working signature further comprises generating a hash value of the working signature by Exclusive-OR'"'"'ing the reference signature with the working signature.

10. A system comprising a processor configured to perform a method, the method comprising:

executing an application, the executing comprising executing a root instruction of the application;

profiling the executing of the application, the profiling comprising storing a reference signature;

determining a working signature of instructions executed subsequent to the executing of the root instruction, the determining comprising utilizing a CALL level and a hashing value of a return address in response to storing the reference signature;

tracking the updating of the working signature by storing a value in a counter indicative of the CALL level; and

updating continuously the working signature with a hashing function while the working signature at least does not match the reference signature;

wherein the hashing function includes a bit wise rotation of the working signature by a predetermined number of bits.

11. The system of claim 10, wherein the updating of the working signature further comprises determining additional auxiliary conditions for the executing application.

12. The system of claim 11, wherein the determining of the additional auxiliary conditions further comprises determining whether an address of the root instruction matches a predetermined address, whether a first value stored in a loop counter matches a second predetermined value, or whether the reference signature matches a hash value of at least one of Exclusive-OR'"'"'ing the address with the working signature or Exclusive-OR'"'"'ing the first value with the working signature.

13. The system of claim 10, wherein the updating of the working signature further comprises executing a call instruction and a return instruction during the execution of the application.

14. The system of claim 10, wherein the updating of the working signature further comprising executing a branch instruction and resuming after the branch instruction during the execution of the application.

15. The system of claim 10, wherein the method further comprises incrementing the value of the counter during the executing of the call instruction and decrementing the value of the counter during the executing of the return instruction.

16. The system of claim 10, wherein the method further comprises initially storing the reference signature as the working signature in response to the executing of the root instruction.

17. The system of claim 10, wherein the working signature comprises a hash value of Exclusive-OR'"'"'ing the reference signature with the working signature.

18. A computer program product comprising:

a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

executing an application, the executing comprising executing a root instruction of the application;

profiling the executing of the application, the profiling comprising storing a reference signature;

determining a working signature of instructions executed subsequent to the executing of the root instruction, the determining comprising utilizing a call level and a hashing value of a return address in response to storing the reference signature;

tracking the updating of the working signature by storing a value in a counter indicative of the call level; and

updating continuously the working signature with a hashing function while the working signature at least does not match the reference signature;

wherein the hashing function includes a bit wise rotation of the working signature by a predetermined number of bits.

19. The computer program product of claim 18, wherein the method further comprises updating of the working signature including determining additional auxiliary conditions for the executing application.

20. The computer program product of claim 19, wherein the determining of the additional auxiliary conditions further comprises determining whether an address of the root instruction matches a predetermined address, whether a first value stored in a loop counter matches a second predetermined value, or whether the reference signature matches a hash value of at least one of Exclusive-OR'"'"'ing the address with the working signature or Exclusive-OR'"'"'ing the first value with the working signature.

21. The computer program product of claim 18, wherein the updating of the working signature further comprises executing a call instruction and a return instruction during the execution of the application.

22. The computer program product of claim 18, wherein the updating of the working signature further comprising executing a branch instruction and resuming after the branch instruction during the execution of the application.

23. The computer program product of claim 18, wherein the method further comprises incrementing the value of the counter during the executing of the call instruction and decrementing the value of the counter during the executing of the return instruction.

24. The computer program product of claim 18, wherein the method further comprises initially storing the reference signature as the working signature in response to the executing of the root instruction.

25. The computer program product of claim 18, wherein the method further comprises generating a hash value of the working signature by Exclusive-OR'"'"'ing the reference signature with the working signature.