Method, a device and a computer program support for verification of checksums for self-modified computer code
View Patent ↗A function of a software program is stored in a memory during execution in a device of the software program. A processor relocates the function in a region of the memory comprising dummy code, transforms the dummy code in a predictable manner, generates a predicted checksum for the region based on a previous checksum, generates a calculated checksum over the region, and verifies the integrity of the function by comparing the predicted checksum and the calculated checksum. Also provided are a device and a computer program product.
1. A method of relocating function code in a memory during execution in a device of a software program comprising the function code, the method comprising the steps in a processor of:
relocating the function code in a region of the memory comprising dummy code during execution of the function code;
transforming the dummy code in a deterministic manner, wherein the transformation of the dummy code comprises permutation;
generating a predicted checksum for the region based on a previous checksum;
generating a calculated checksum over the region; and
verifying the integrity of the function code by comparing the predicted checksum and the calculated checksum, where the checksum for the region is a combination of a checksum for the function code and a checksum for the dummy code.
2. The method of claim 1 , wherein the function code is position independent code, and wherein the function code has with a constant checksum value.
3. The method of claim 1 , wherein the checksum of the function code for the predicted checksum is calculated using a relocation table.
4. The method of claim 1 , wherein a checksum of the dummy code is unchanged by the transformation.
5. The method of claim 1 , wherein the transformation of the dummy code comprises permutation as blocks of a predetermined size.
6. The method of claim 1 , wherein the transformation is linear with a deterministic effect on the checksum of the dummy code.
7. The method of claim 1 , wherein the region of the memory comprises further function code and further dummy code that also are used when a checksum value is calculated.
8. The method of claim 1 , wherein the dummy code is real code.
9. The method of claim 1 , wherein the function code is implemented as a module or as an instruction block.
10. The method of claim 1 , wherein the previous checksum is a checksum for the region.
11. A device for execution of a software program and relocation of function code of the software program in a memory during execution of the software program, the device comprising:
a memory for storing the function code and dummy code in a region of the memory; and
a processor for:
relocating the function code in the region of the memory during execution of the function code;
transforming the dummy code in a deterministic manner, wherein the transformation of the dummy code comprises permutation;
generating a predicted checksum for the region based on a previous checksum;
generating a calculated checksum over the region; and
verifying the integrity of the function code by comparing the predicted checksum and the calculated checksum, wherein the checksum for the region is a combination of a checksum for the function code and a checksum for the dummy code.
12. The device of claim 10 , wherein the function code is position independent code, and wherein the function code has with a constant checksum value.
13. The device of claim 10 , wherein the processor calculates the checksum of the function code for the predicted checksum using a relocation table.
14. The device of claim 11 , wherein the checksum of the dummy code is unchanged by the transformation.
15. The device of claim 14 , wherein the processor uses permutation as blocks of a predetermined size to perform the transformation of the dummy code.
16. The device of claim 10 , wherein the transformation is linear with a deterministic effect on the checksum of the dummy code.
17. The device of claim 11 , wherein the region of the memory comprises further function code and further dummy code that also are used when a checksum value is calculated.
18. The device of claim 11 , wherein the dummy code is real code.
19. The device of claim 11 , wherein the function code is implemented as a module or as an instruction block.
20. The device of claim 11 , wherein the previous checksum is a checksum for the region.
21. A non-transitory computer program product having stored thereon instructions of a software program, wherein the instructions, when stored in a memory and executed by a processor performs the steps of:
relocating relocates function code of the software program in a region of the memory comprising dummy code during the execution of the function code;
transforming transforms the dummy code in a deterministic manner, wherein the transformation of the dummy code comprises permutation;
generating generates a predicted checksum for the region based on a previous checksum; generating a calculated checksum over the region; and
verifying verifies the integrity of the function code by comparing the predicted checksum and the calculated checksum, where the checksum for the region is a combination of a checksum for the function code and a checksum for the dummy code.