Preventing execution of tampered application code in a computer system
View Patent ↗Methods and systems for preventing an application which has been maliciously or inadvertently tampered with from causing harm to a computer system are described. Application code of the tampered application is inputted into a code analyzer. The code is analyzed and functions within the application code are identified and examined. A profile is created and may be a description of how a function is intended to operate, that is, the function's expected behavior. Calls between functions are examined and a called function is replaced with a replacement function, such that a call to an original function results in a call to the replacement function. The original function is unaware that it is not getting function calls or that such calls are being directed to a replacement function or stub. A replacement function contains code to ensure that the user space maintains its original appearance.
1. A method of preventing a tampered application from causing harm to a computer system, the method comprising:
analyzing compiled source code by examining a plurality of functions in the source code, said analyzing executed by a processor wherein compiled source code is obtained using a suitable compiler depending on source code language;
for a specific function from the plurality of functions, utilizing a code analyzer to identify a set of calling functions and a set of called functions wherein each called function is considered a verified called function and each calling function is considered a verified calling function said utilizing executed by the processor;
generating a profile for the specific function, said profile indicating correct behavior of the specific function and including the set of calling functions and the set of called functions;
further comprising running object code of the application through a linker utility program to replace the function being called with the stub;
executing the compiled source code wherein when the specific function executes and calls a first function which is verified as a legitimate called function by examining the profile of the specific function a first stub function executes instead of the first function; and
preventing the tampered application from allowing malware to be installed on the computer system or from allowing malicious functions to execute on the computer system.
2. A method as recited in claim 1 further comprising examining calls between functions and replacing a verified called function with a stub, said examining executed by said processor.
3. A method as recited in claim 2 further comprising calling the stub when making a call to an original function, said calling executed by said processor.
4. A method as recited in claim 3 further comprising ensuring that a verified called function is unaware that it is not getting function calls, said ensuring executed by said processor.
5. A method as recited in claim 2 further comprising including code in the stub to ensure that a user space maintains its original appearance.
6. A method as recited in claim 1 further comprising inputting a library into a code analyzer, said inputting performed by said processor.