Prevention of executable code modification
Prevention of executable code modification is provided by making the act of allocating and modifying existing memory backed code pages a highly privileged operating system (OS) function. The integrity of loaded code is also optionally checked at load time inside the OS kernel. A privilege check in the system is invoked when executable pages are allocated or modified. This privilege is assigned only to the operating system kernel and highly trusted identities in the operating system.
1 . A method for prevention of executable code modification comprising:
restricting a function of loading executable code into memory to a privileged ring of a computer's operating system (OS).
2 . The method of claim 1 further comprising enforcing page-level protection of the executable code.
3 . The method of claim 2 further comprising invoking a privilege check when an executable page of the executable code is allocated or when an attribute of the executable page is changed.
4 . The method of claim 3 wherein the privilege check determines whether a privilege that is only assigned to the privileged ring of the OS is present before allowing the allocation of the executable page or change of the attribute of the executable page.
5 . The method of claim 4 further comprising checking integrity of the executable code after it is loaded.
6 . The method of claim 5 wherein the page level protection is performed using hardware-based enforcement and tracking of executable pages.
7 . A computer readable medium having instructions thereon for performing the step of claim 1 .
8 . A computer readable medium having instructions thereon for performing the steps of claim 2 .
9 . A computer readable medium having instructions thereon for performing the steps of claim 3 .
10 . A computer readable medium having instructions thereon for performing the steps of claim 4 .
11 . A computer readable medium having instructions thereon for performing the steps of claim 5 .
12 . A computer readable medium having instructions thereon for performing the steps of claim 6 .
13 . A system for prevention of executable code modification comprising:
means for restricting a function of loading executable code into memory to a privileged ring of a computer's operating system (OS).
14 . The system of claim 13 further comprising means for enforcing page-level protection of the executable code.
15 . The system of claim 14 further comprising means for invoking a privilege check when an executable page of the executable code is allocated or when an attribute of the executable page is changed.
16 . The system of claim 15 wherein the means for invoking the privilege check determines whether a privilege that is only assigned to the privileged ring of the OS is present before allowing the allocation of the executable page or change of the attribute of the executable page.
17 . The system of claim 16 further comprising means for checking integrity of the executable code after it is loaded.
18 . The system of claim 17 wherein the means for enforcing page level protection comprises means for hardware-based enforcement and tracking of executable pages.
19 . A method for prevention of modification of data pages comprising:
restricting a function of loading data pages into memory to a privileged ring of a computer's operating system (OS).
20 . A computer readable medium having instructions thereon for performing the step of claim 19.