System and method for protecting software from buffer overruns
A compiler transforms the source code into object code, but it will postpone the assignment of all of the machine language jumps until installed time. This can be performed by labeling the jumps during compiled time, similarly to how variables are labeled for later indexing by the debugger. At installation time, given a random key, the installer will take the jump labels and assign random ordering of the code and data using the key as a seed. The final effect is that the same source code can potentially generate an infinite number of object codes, with the exact same functionality of execution. The main difference, however, is that as more jump labels are included, less fixed offsets between buffers are available to the black hat.
1. A method designed to detect and defend against buffer overruns, executable by a machine, comprising:
providing an application that is compiled in object code, wherein the compiling identifies at least one jump point in the object code; and
providing a specialized installer that, upon execution,
randomizes the object code at the instruction level by assigning a random memory location for the at least one jump in the object code.
2. The method in claim 1 , wherein the installer detects the object code generated by a conventional compiler, removes any memory allocation data, and uses the at least one jump point to generate the random memory locations assignment.
3. The method in claim 1 or 2 , wherein the installer randomizes the object code based on a key or random seed.
4. The method in claim 1 or 2 , where the randomization is not based on a derivate of the time.
5. The method in claim 1 or 2 , wherein the at least one jump point in the object code is complemented with at least one new jump point added by the installer.
6. The method in claim 1 or 2 , wherein the installer alters the object code by changing the location of statically allocated variables or constants.
7. The method in claim 1 , 2 , or 6 , wherein the installer causes an allocating and deallocating of arbitrary memory chunks to force random offsets between the data allocated and the other data and code.
8. A method of providing enhanced installed application security, comprising:
compiling, by a compiler executed by a processing device, source code for an application, thereby generating object code for the application, wherein the object code comprises at least one labeled jump point, and wherein the compiling comprises postponing a memory location assignment for the at least one labeled jump point;
installing, by an installer, the application, wherein the installing comprises (i) identifying a random key and (ii) assigning, based on the random key, a memory location to the at least one labeled jump point.
9. The method of claim 8 , wherein the installing further comprises (iii) adding at least one additional jump point to the object code and (iv) assigning a memory location to the at least one additional jump point.
10. The method of claim 8 , wherein the installing further comprises (iii) shifting an order of at least one: (a) statically allocated variable, and (b) statically allocated constant.