Methods for detecting executable code which has been altered
View Patent ↗Methods of detecting executable code which has been altered are provided. Upon an initial loading of an executable code a calculation is performed to generate a score associated with the executable code, the initial score is retained. Subsequently, one or more additional calculations are performed on the executable code to generate subsequent scores. Any subsequent score not matching the initial score indicates the executable code has been altered in some way. If alteration has occurred, then the executable code is partially or completely disabled and optionally unloaded from the operating system within which it resides. Moreover, an owner associated with the altered executable code may be notified, or other events may be triggered as a result of scores which when compared are not equal. Calculations may be performed on the executable code randomly, at pre-defined intervals, or upon a specific request.
1. A method for validating executable code resident in an operating system having executable instructions, comprising the steps of:
identifying an executable code having an unaltered size;
calculating an initial score associated with the executable code when the executable code is initially or shortly thereafter loaded into an operating system;
saving the initial score;
randomly and substantially each time the executable code is launched for use, calculating a plurality of subsequent scores on the executable code;
exclusively comparing each of the subsequent scores to the saved initial score and to no other scores;
if the each of the subsequent scores do not vary from the saved initial score, concluding the executable code maintains the unaltered size; and
if any of the subsequent scores vary from the saved score, concluding the executable code has an altered size.
2. The method of claim 1 , further comprising the steps of:
unloading the executable code from the operating system if the saved initial score is not equal to the any of the subsequent scores.
3. The method of claim 1 , further comprising the steps of:
disabling at least a portion of the executable code if the saved initial score is not equal to the any of the subsequent scores.
4. The method of claim 1 , wherein the scores are the result of a checksum calculation.
5. The method of claim 1 , further comprising the steps of:
notifying electronically an owner of the executable code if the saved initial score is not equal to the any of the subsequent scores.
6. A method for disabling executable code which has been modified without authorization having executable instructions, comprising the steps of:
identifying an executable code in an operating system having an unaltered format;
calculating a score associated with the executable code exclusively within an operating system of a computing device independent of a system management mode of operation;
randomly and substantially each time the executable code is launched for use, calculating subsequent scores associated with the executable code;
determining the executable code has an altered format if the score is not equal to any of the subsequent scores, the determining exclusively including comparing each of the subsequent scores to the score with no other score comparisons occurring; and
disabling the executable code if the score is not equal to any of the subsequent scores.
7. The method of claim 6 , further comprising the steps of:
notifying an owner of the executable code if disabled.
8. The method of claim 6 , wherein the scores are the result of a checksum calculation.
9. The method of claim 6 , wherein the subsequent scores are further calculated at one or more predetermined time intervals.
10. The method of claim 6 , further comprising the steps of:
removing the executable code if disabled from a memory of the operating system wherein the executable code resides.
11. The method of claim 6 , further comprising the steps of:
assisting in the loading of the executable code, if not disabled, to a memory of the operating system wherein the executable code resides.
12. The method of claim 6 , further comprising the steps of:
registering the executable code if not disabled; and recording a history if the executable code is disabled.
13. A method of authenticating executable code resident in a memory having executable instructions comprising the steps of:
identifying an executable code having an unaltered format;
acquiring a score associated with an executable code which was established when the executable code was first loaded into a memory of an operating system;
randomly and substantially each time the executable code is launched for use after the executable code is said first loaded, receiving subsequent scores on the executable code while the executable code is in the memory;
exclusively comparing the subsequent scores to the score with neither the subsequent scores nor the score being compared to any other values;
if the subsequent scores do not vary from the score, executing the executable code in the unaltered format; and
if any of the subsequent scores vary from the saved score, indicating the executable code has an altered format.
14. The method of claim 13 , further comprising the steps of:
disabling the executable code while the executable code is in the memory when the any of the subsequent scores is not equal to the score.
15. The method of claim 13 , further comprising the steps of:
suspending one or more operations of the executable code while the executable code is executing in the memory when the any of the subsequent scores is not equal to the score.
16. The method of claim 13 , wherein the subsequent scores are received each time the executable code is initiated in the memory for an execution.
17. The method of claim 13 , reporting one or more system events and variables when the any of the subsequent scores is not equal to the score.
18. Functional data used to validate executable code embodied in a computer readable medium, the data comprising:
an unaltered original format;
a first score associated with an executable code when the executable code is initially loaded into an operating system;
a plurality of second scores associated with the executable code at 1) a random period of time subsequent to when the executable code was initially loaded and 2) substantially each time the executable code is launched for use subsequent to when the executable code was initially loaded and each second score being operable to be exclusively compared with the first score to determine if the executable code has been altered since the initial load; and
an altered unoriginal format if the first and second scores do not equal.
19. A system for validating executable code, comprising:
an executable code having an unaltered size;
a scoring set of executable instructions operable to receive and record a score associated with the executable code when the code is initially loaded into a computer readable medium;
a comparing set of executable instructions in an operating system of a computing device independent of a system management mode of operation operable to receive subsequent scores associated with the code and to randomly and substantially each time the executable code is launched for use exclusively compare the score and the subsequent scores to determine if the code has been altered; and
an executable code having an altered size if the score and the subsequent scores do not equal.