Software protection from attacks using self-debugging techniques
In overview, methods, computer programs products and devices for securing software are provided. In accordance with the disclosure, a method may comprise attaching a debugger process to a software process. During execution of the software process, operations relevant to the functionality of the code process are carried out within the debugger process. As a result, the debugger process cannot be replaced or subverted without impinging on the functionality of the software process. The software process can therefore be protected from inspection by modified or malicious debugging techniques.
1. A method for securing software, comprising:
executing a debuggee process with an attached debugger process such that the debugger process is invoked at least once; and
performing a function within the debugger process in response to invoking the debugger process, the function output dependent on data associated with the debuggee process,
wherein, when an entry point to the function is reached while executing the debuggee process, serializing first parameters of the function into a state structure followed by executing an exception-inducing instruction and thereby causing an exception triggering the debugger process which identifies a debuggee location of the exception, and
wherein the debuggee process generates a data structure having second parameters required for execution of the function prior to invoking the debugger process.
2. The method as recited in claim 1 , wherein the function output includes a data output for use by the debuggee process.
3. The method as recited in claim 1 , wherein the data structure is a state structure.
4. The method as recited in claim 1 , wherein the debuggee process acts to debug the debugger process.
5. The method as recited in claim 1 , further comprising launching an additional process to debug the debugger process.
6. The method as recited in claim 1 , wherein output of a given function indicates multiple points of return within the debuggee process for continued execution.
7. The method as recited in claim 1 , wherein the debugger process provides memory support capabilities to enable the function to retrieve data from memory within address space of the debuggee process.
8. The method as recited in claim 1 , wherein the debugger process is invoked when a break point within the debuggee process is reached.
9. The method as recited in claim 1 , further comprising detaching the debugger process from the debuggee process when the debuggee process is complete.
10. The method as recited in claim 1 , wherein the debuggee process implements an executable such as an application.
11. The method as recited in claim 1 , wherein the debuggee process implements a library.
12. A computing device for securing software comprising:
a processor for executing code that implements the following steps on a computing device;
executing a debuggee process with an attached debugger process such that the debugger process is invoked at least once; and
performing a function within the debugger process in response to invoking the debugger process, the function output dependent on data associated with the debuggee process,
wherein, when an entry point to the function is reached while executing the debuggee process, serializing first parameters of the function into a state structure followed by executing an exception-inducing instruction and thereby causing an exception triggering the debugger process which identifies a debuggee location of the exception, and
wherein the debuggee process generates a data structure having second parameters required for execution of the function prior to invoking the debugger process.