Information security method and system
View Patent ↗The present invention discloses an improved information security system and method. A polymorphic engine is used to enhance the security features of a software application and the data generated by or made available to the application and/or the operating system. The polymorphic engine operates to randomly alter the standard executable code of the original application while preserving its functional characteristics. Each polymorphed instance of the application differs from any other instance of the same application in form only. Various other security features operate to protect the polymorphic engine itself and/or the polymorphed code generated therefrom. These other security features include: just-in-time instruction code decryption; virtual CPU instruction code pre-processing; call mutation; stack manipulation; secure hook-capture of device input; secure display device output; application level decryption of encrypted hardware data streams; and a dynamic, randomly configured graphical keypad interface.
1. A computer system for modifying compiled code of an application while substantially preserving operational and functional characteristics thereof, the computer system comprising:
a processor;
means, executable by the processor, for providing the compiled code;
means, executable by the processor, for detecting a program execution jump in the compiled code that requires header data for execution;
means, executable by the processor, for overwriting the header data and generating overwritten header data to prevent the program execution jump;
means, executable by the processor, for redirecting program execution to a resolution subroutine; and
correlation means, executable by the processor, for enabling the resolution subroutine to execute a program jump to an appropriate codebase with the overwritten header data.
2. A computer-implemented method of modifying compiled code of an application while substantially preserving operational and functional characteristics thereof comprising:
using a computer processor configured to execute method steps, the steps comprising:
detecting a program execution jump in the compiled code that requires header data for execution;
overwriting the header data and generating overwritten header data to prevent the program execution jump;
redirecting program execution; and
executing a program jump to an appropriate codebase with the overwritten header data.
3. The method of claim 2 , wherein said redirecting is accomplished by correlating EIP data with API placeholder data.
4. The method of claim 3 , wherein the API placeholder data is encrypted.
5. A computer-implemented method of securely executing compiled code of an application while substantially preserving operational and functional characteristics thereof, the computer-implemented method comprising:
providing a platform having a CPU, said CPU having a program stack;
providing compiled code;
replacing dynamically at least a first call and a first plurality of instructions in the compiled code with a second call to a second plurality of instructions, wherein the second plurality of instructions is written substantially directly to the program stack, and wherein the second plurality of instructions substantially replicates the function of the first plurality of instructions; and
removing the first call from the compiled code.
6. The method of claim 5 , wherein either or both of the first call and the second call are encrypted.
7. The method of claim 5 , wherein the first call is an API call.
8. The method of claim 5 wherein the second plurality of instructions is a polymorphic variant of the first plurality of instructions.
9. The method of claim 5 , further comprising removing the first plurality of instructions from the compiled code.
10. The method of claim 5 , wherein a polymorphic wrap process dynamically replaces the first call and the first set of instructions with the second call to the second plurality of instructions.
11. The method of claim 2 , wherein the overwritten header data generated is erroneous data that destroys an original call associated with the program execution jump without destroying program function.
12. The method of claim 2 , wherein redirecting program execution further comprises rerouting an original call to a substitute call comprising a resolution subroutine of a polymorphic engine that queries a stack pointer of a program stack for the application to determine from where the substitute call originated.
13. The method of claim 12 , further comprising comparing data obtained from the stack pointer to a matchable data structure to pass program execution control an appropriate routine specified by the header data originally present before overwriting, wherein the appropriate routine is called using the original header data.