Systems and methods for runtime enforcement of data flow integrity
Disclosed herein are embodiments of systems, methods, and products comprise a processor, which provides runtime enforcement of data flow integrity. The processor accesses the application binary file from the disk to execute an application and translates the application binary into intermediate representation. The processor applies the logic of data flow integrity controls to the intermediate representation. Specifically, the processor identifies the vulnerable code in the intermediate representation. The processor applies data flow integrity controls to the vulnerable code. The processor adds simple instrumentation that only changes the application's behavior when unauthorized data tampering occurs while preserving the application's normal behavior. When certain operations may cause unauthorized data tampering, the processor takes proper measures to stop the operations. The processor translates the intermediate representation back to a machine code and replaces the original binary with the machine code.
1. A computer implemented method comprising:
accessing, by a processor, an application binary of a binary file corresponding to an application from a non-transitory storage medium;
translating, by the processor, the application binary of the binary file into intermediate representation, wherein the intermediate representation comprises an intermediate graph structure for data flow analysis, the intermediate graph structure constructed by executing the application binary in a controlled virtual environment;
applying, by the processor, data flow integrity control logic to a set of code within the intermediate representation by checking structure of data layout in memory and tracking usage of memory area for an unauthorized data tampering behavior;
adding, by the processor, to the set of code an instrumentation configured to correct the unauthorized data tampering behavior; and
translating, by the processor, the intermediate representation with the added instrumentation into a machine code.
2. The method of claim 1 , wherein the unauthorized data tampering behavior is a non-control data attack comprising at least of loss of data security, memory corruption, buffer overflow, and stack smashing.
3. The method of claim 1 , wherein the set of code comprises code for read and write instructions in the intermediate representation.
4. The method of claim 1 , further comprising:
applying, by the processor, the data flow integrity controls by analyzing a reaching definition of the intermediate representation.
5. The method of claim 1 , wherein the instrumentation comprises changing the unauthorized data tampering behavior while preserving normal behavior.
6. The method of claim 1 , wherein the instrumentation comprises killing the application.
7. The method of claim 1 , further comprising:
adding, by the processor, instrumentation to the set of code by implementing a functional runtime for write instructions to verify the last writer of a operand is a member of a set of allowed writers.
8. The method of claim 1 , further comprising:
replacing, by the processor, the application binary of the binary file with the machine code by rewriting the machine code to a new position in the non-transitory storage medium and deleting the application binary.
9. The method of claim 1 , wherein the intermediate representation is low level virtual machine (LLVM) intermediate representation.
10. The method of claim 1 , wherein the processor enforces the data flow integrity controls in runtime.
11. A system comprising:
a non-transitory storage medium configured to store a binary file corresponding to an application;
a processor connected to the non-transitory storage medium and configured to:
access application binary of the binary file from the non-transitory storage medium;
translate the application binary of the binary file into intermediate representation, wherein the intermediate representation comprises an intermediate graph structure for data flow analysis, the intermediate graph structure constructed by executing the application binary in a controlled virtual environment;
apply data flow integrity control logic to a set of code within the intermediate representation by checking structure of data layout in memory, tracking usage of memory area for unauthorized data tampering behavior;
add to the set of code an instrumentation configured to correct the unauthorized data tampering behavior; and
translate the intermediate representation with the added instrumentation into a machine code.
12. The system of claim 11 , wherein the unauthorized data tampering behavior is a non-control data attack comprising at least one of loss of data security, memory corruption, buffer overflow, and stack smashing.
13. The system of claim 11 , wherein the set of code comprises code for read and write instructions in the intermediate representation.
14. The system of claim 11 , wherein the processor is further configured to:
apply the data flow integrity controls by analyzing reaching definition of the intermediate representation.
15. The system of claim 11 , wherein the instrumentation comprises changing the unauthorized data tampering behavior while preserving normal behavior.
16. The system of claim 11 , wherein the instrumentation comprises killing the application.
17. The system of claim 11 , wherein the processor is further configured to:
adding, by the processor, instrumentation to the set of code by implementing a functional runtime for write instructions to verify the last writer of a operand is a member of a set of allowed writers.
18. The system of claim 11 , wherein the processor is further configured to:
replace the application binary of the binary file with the machine code by rewriting the machine code to a new position in the non-transitory storage medium and deleting the application binary.
19. The system of claim 11 , wherein the intermediate representation is low level virtual machine (LLVM) intermediate representation.
20. The system of claim 11 , wherein the processor enforces the data flow integrity controls in runtime.