Software integrity checking systems and methods
This disclosure relates to systems and methods generating and distributing protected software applications. In certain embodiments, integrity checking mechanisms may be implemented using integrity checking code in software code prior to compilation into machine code. Following compilation and execution of the application, the introduced code may check the integrity of the application by determining whether the application behaves and/or otherwise functions as expected. By introducing integrity checking in this manner, integrity checking techniques may be injected into the application prior to compilation into machine code and/or independent of the particular manner in which the application is compiled.
1. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor of a system, cause the system to perform a method comprising:
detecting an initial execution of an application on the system, the application having been received from an application store system, the application comprising one or more functional integrity checks;
executing, at least in part in response to the detection of the initial execution, the one or more functional integrity checks of the application to verify that one or more portions of the application associated with the one or more functional integrity checks function according to a defined behavior, wherein executing the one or more functional integrity checks comprises verifying that one or more resource calls associated with the one or more portions of the application correspond with an expected resource call behavior;
generating, based on verifying that the one or more portions of the application function according to the defined behavior, one or more first integrity check values;
storing the one or more first integrity check values on a user device; and
allowing, based on the verifying that the one or more portions of the application function according to the defined behavior, the initial execution of the application to proceed.
2. The non-transitory computer-readable medium of claim 1 , wherein the one or more resource calls comprise one or more function calls and the expected resource call behavior comprises an expected function call behavior.
3. The non-transitory computer-readable medium of claim 1 , wherein the one or more functional integrity checks comprise code appended to the application.
4. The non-transitory computer-readable medium of claim 1 , wherein the one or more functional integrity checks comprise code injected into a plurality of locations in the application.
5. The non-transitory computer-readable medium of claim 1 , wherein the one or more functional integrity checks comprise obfuscated code.
6. The non-transitory computer-readable medium of claim 1 , wherein storing the one or more first integrity check values on the user device comprises storing the one or more first integrity check values in a secure storage space of the user device.
7. The non-transitory computer-readable medium of claim 1 , wherein storing the one or more first integrity check values on the user device comprises inserting the one or more first integrity check values in one or more locations of the application.
8. The non-transitory computer-readable medium of claim 1 , wherein the application further comprises one or more comparison integrity checks.
9. The non-transitory computer-readable medium of claim 8 , wherein the one or more first integrity check values comprise at least one result of a first operation performed on at least one portion of the one or more portions of the application.
10. The non-transitory computer-readable medium of claim 9 , wherein the first operation comprises a hashing operation and the one or more first integrity check values comprise one or more hash values.
11. The non-transitory computer-readable medium of claim 9 , wherein the method further comprises:
detecting a subsequent execution of the application; and
in response to detecting the subsequent execution of the application, executing the one or more comparison integrity checks.
12. The non-transitory computer-readable medium of claim 11 , wherein executing the one or more comparison integrity checks comprises:
generating one or more second integrity check values;
determining that the one or more second integrity check values match corresponding values of the one or more first integrity check values; and
allowing, based on determining that the one or more second integrity check values match corresponding values of the one or more first integrity check values, the subsequent execution of the application to proceed.
13. The non-transitory computer-readable medium of claim 12 , wherein generating the one or more second integrity check values comprises performing a second operation on the at least one portion of the one or more portions of the application.
14. The non-transitory computer-readable medium of claim 13 , wherein the one or more first integrity check values and the one or more second integrity check values comprise hash values, and wherein determining that the one or more second integrity check values match corresponding values of the one or more first integrity check values comprises comparing the hash values.
15. The non-transitory computer-readable medium of claim 1 , wherein the application is compiled by the application store system.