Code integrity protection by computing target addresses from checksums

• US 9,405,936 B2
• Filed: 12/16/2014
• Issued: 08/02/2016
• Est. Priority Date: 12/16/2014
• Status: Active Grant

• Current Assignee: NXP B.V. (NXP Semiconductors NV)
• Original Assignee: NXP B.V. (NXP Semiconductors NV)
• Inventors: Hoogerbrugge, Jan, Michiels, Wil
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/572,356
• Publication Number:
  US 20160171246A1
• Time in Patent Office: 595 Days
• Field of Search: 726/26
• US Class Current: 1/1
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 2221/2123 Dummy operation
• CPC Class Codes: G06F 8/70 Software maintenance or management

Abstract

A method of obscuring software code including a plurality of basic blocks, including: calculating, by a processor, a checksum value of the current basic block and a pointer to the end of the current basic block; determining a preceding basic block for the current basic block; inserting the checksum value for the current basic block into the preceding basic block; and inserting instructions into the preceding basic block to determine a pointer to the beginning of the current basic block based upon the checksum value of the current basic block.

Claims

1. A method of obscuring software code of a current basic block of a plurality of basic blocks, comprising:

calculating, by a processor device, a checksum value of the current basic block of the software code and a pointer to the end of the current basic block;

determining a preceding basic block for the current basic block;

inserting the checksum value for the current basic block into the preceding basic block; and

inserting instructions into the preceding basic block to determine a pointer to the beginning of the current basic block based upon the checksum value of the current basic block.

2. The method of claim 1, further comprising:

inserting instructions into the preceding basic block for determining a last basic block; and

inserting instructions into the preceding basic block for setting the current basic block as the last basic block.

3. The method of claim 1, further comprising inserting instructions for setting the current block to the preceding block.

4. The method of claim 3, further comprising repeating the steps of calculating the checksum value of the current basic block, determining the preceding basic block, inserting the checksum value, inserting instructions into the preceding basic block, and setting the current block to the preceding block until a first basic block is reached.

5. The method of claim 4, further comprising calculating a checksum value of the current basic block and a pointer to the end of the first basic block and providing the checksum value of the first block and pointer to end of the first block to an application that calls the first basic block.

6. The method of claim 1, further comprising inserting junk code between the current basic block and the preceding basic block.

7. The method of claim 1, wherein instructions to determine a pointer to the beginning of the current basic block further includes repeatedly calculating a checksum of the current basic block and decrementing a pointer to the current basic block until the calculated checksum value equals a previously calculated checksum value for the current basic block, wherein an initial value of the pointer is to the end of the current basic block.

8. The method of claim 7, further comprising determining the calculated checksum value prematurely equals the previously calculated checksum value for the current basic block.

9. The method of claim 8, further comprising when the calculated checksum value prematurely equals the previously calculated checksum, modifying the code of the current basic block to prevent the calculated checksum value from prematurely equaling the previously calculated checksum.

10. The method of claim 7, wherein calculating the checksum of the current basic block is based upon the value of the pointer.

11. A non-transitory machine-readable storage medium encoded with instructions for checking integrity of a basic block next to a current basic block of software code of a plurality of basic blocks for execution by a processor device, the non-transitory machine-readable storage medium comprising:

instructions for calculating a checksum value for the next basic block in the processor device;

instructions for setting a pointer to the end of the next basic block and inserting the checksum into the current basic block;

instructions for determining the beginning of the next basic block using the pointer and the checksum value.

12. The non-transitory machine-readable storage medium of claim 11 wherein determining the beginning of the next basic block includes decrementing the pointer based upon an iterative validation of the checksum of the next basic block to determine the beginning of the next basic block.

13. The non-transitory machine-readable storage medium of claim 12, wherein the iterative validation of the checksum is based upon the value of the pointer.

14. The non-transitory machine-readable storage medium of claim 12, wherein initializing a checksum value for the next basic block includes using an embedded checksum value for the next basic block.

15. The non-transitory machine-readable storage medium of claim 11 further comprising:

instructions for a preceding basic block that precedes a current basic block comprising;

instructions for initializing a checksum value for the current basic block;

instructions for setting a pointer to the end of the current basic block; and

instructions for determining the beginning of the current basic block.

16. The non-transitory machine-readable storage medium of claim 11, further comprising instructions for setting the current block to the preceding block.

17. The non-transitory machine-readable storage medium of claim 11, further comprising instructions for junk code between the current basic block and the next basic block.

18. The non-transitory machine-readable storage medium of claim 11, further comprising instructions for determining the next basic block based upon a condition wherein:

initializing a checksum value for the next basic block depends upon the condition; and

setting a pointer to the end of the next basic block depends upon the condition.

19. A method to check the integrity of a basic block next to a current basic block of software code of a plurality of basic blocks for execution by a processor device, comprising:

calculating a checksum value for the next basic block in the processor device;

setting a pointer to the end of the next basic block and inserting the checksum into the current basic block; and

determining the beginning of the next basic block using the pointer and the checksum value.

20. The method of claim 19, wherein determining the beginning of the next basic block includes decrementing the pointer based upon an iterative validation of the checksum of the next basic block to determine the beginning of the next basic block.

21. The method of claim 20, wherein the iterative validation of the checksum is based upon the value of the pointer.

22. The method of claim 20, wherein initializing a checksum value for the next basic block includes using an embedded checksum value for the next basic block.

23. The method of claim 19, further comprising:

for a preceding basic block that precedes the current basic block comprising;

initializing a checksum value for the current basic block;

setting a pointer to the end of the current basic block; and

determining the beginning of the current basic block.

24. The method of claim 19, further comprising setting the current block to the preceding block.

25. The method of claim 19, further comprising determining the next basic block based upon a condition wherein:

initializing a checksum value for the next basic block depends upon the condition; and

setting a pointer to the end of the next basic block depends upon the condition.