System and method for call path enforcement
Disclosed herein are systems, computer-implemented methods, and computer-readable storage media for call path enforcement. The method includes tracking, during run-time, a run-time call order for a series of function calls in a software program, and when executing a protected function call during run-time, allowing or causing proper execution of a protected function call only if the run-time call order matches a predetermined order. The predetermined order can be an expected run-time call order based on a programmed order of function calls in the software program. The method can include maintaining an evolving value associated with the run-time call order and calling the protected function by passing the evolving value and function parameters corrupted based on the evolving value. The protected function uncorrupts the corrupted parameters based on the passed evolving value and an expected predetermined call order. A buffer containing the uncorrupted parameters can replace the corrupted parameters.
1. A computer-implemented method for call path enforcement, the method comprising:
tracking via a processor, during run-time, a first run-time call order for a series of function calls in a software program;
maintaining an evolving value associated with the first run-time call order;
transforming a subset of function parameters associated with a protected function based on the first run-time call order and the evolving value prior to calling the protected function;
calling the protected function;
generating a second run-time call order by re-calculating the series of function calls inside the protected function;
un-transforming the subset of function parameters based on the second run-time call order and the evolving value when inside the protected function; and
executing the protected function based on the un-transformed parameters, wherein execution of the protected function is proper only if the first run-time call order matches the second run-time call order.
2. The computer-implemented method of claim 1 , wherein transforming the subset of function parameters comprises corrupting the subset of function parameters based on the first run-time call order and the evolving value; and wherein un-transforming the subset of function parameters comprises un-corrupting the subset of function parameters based on the second run-time call order and the evolving value when inside the protected function.
3. The computer-implemented method of claim 1 , wherein transforming the subset of function parameters comprises placing the subset of function parameters in a buffer passed to the protected function, wherein the subset of function parameters are arranged in the buffer based on the first run-time call order and the evolving value; and wherein un-transforming the subset of function parameters comprises extracting the subset of function parameters from the buffer based on the second run-time call order and the evolving value inside the protected function.
4. The computer-implemented method of claim 1 , wherein transforming the subset of function parameters comprises:
placing the subset of function parameters in a global buffer, wherein the subset of function parameters are arranged in the global buffer based on the second run-time call order and the evolving value; and wherein un-transforming the subset of function parameters comprises extracting the subset of function parameters from the global buffer based on the second run-time call order and the evolving value inside the protected function.
5. A system for including call path enforcement instructions in computer code, the system comprising:
a processor;
an insertion module configured to control the processor to insert instructions in the computer code wherein the inserted instructions include instructions to:
maintain, during run-time, a first run-time call order for a sequence of function calls and an evolving value associated with the first run-time call order;
transform a subset of function parameters associated with a protected function based on the first run-time call order and the evolving value prior to calling the protected function;
generate a second run-time call order by re-calculating the sequence of function calls inside the protected function; and
un-transform the subset of function parameters based on the second run-time call order and the evolving value inside the protected function.
6. The system of claim 5 , the system further comprising a compiling module configured to control the processor to compile the computer code with the inserted instructions to a binary.
7. The system of claim 5 , wherein the insertion module is further configured to control the processor to insert the instructions in multiple locations throughout the computer code.
8. The system of claim 5 , wherein the instructions inserted to transform a subset of function parameters includes instructions to corrupt the subset of function parameters based on the first run-time call order and the evolving value prior to calling the protected function; and
wherein the instructions inserted to un-transform the subset of function parameters includes instructions to uncorrupt the subset of function parameters based on the second run-time call order and the evolving value inside the protected function.
9. The system of claim 5 , wherein the instructions inserted to transform a subset of function parameters includes instructions to place the subset of function parameters in a buffer, wherein the subset of function parameters are arranged in the buffer based on the first run-time call order and the evolving value; and
wherein the instructions inserted to un-transform the subset of function parameters includes instructions to extract the subset of function parameters from the buffer based on the second run-time call order and the evolving value inside the protected function.
10. The system of claim 5 , wherein the instructions inserted to transform a subset of function parameters includes instructions to place the subset of function parameters in a global buffer, wherein the subset of function parameters are arranged in the global buffer based on the first run-time call order and the evolving value; and
wherein the instructions inserted to un-transform the subset of function parameters includes instructions to extract the subset of function parameters from the global buffer based on the second run-time call order and the evolving value inside the protected function.
11. A non-transitory computer-readable storage medium storing a computer program having program instructions which, when executed by a computing device, causes the computing device to perform steps comprising:
tracking during run-time of the computer program a first run-time call order for a series of function calls in the computer program;
maintaining an evolving value associated with the first run-time call order;
transforming a subset of function parameters associated with a protected function in the computer program based on the first run-time call order and the evolving value prior to calling the protected function;
calling the protected function;
generating a second run-time call order by re-calculating the series of function calls inside the protected function;
un-transforming the subset of function parameters based on the second run-time call order and the evolving value when inside the protected function; and
executing the protected function based on the un-transformed parameters, wherein proper execution of the protected function occurs when the first run-time call order matches the second run-time call order.
12. The non-transitory computer-readable storage medium of claim 11 , the instructions further comprising:
if the first run-time call order does not match the second run-time call order, corrupting data used by the computer program.
13. A non-transitory computer-readable storage medium storing a computer program having instructions for controlling a processor to embed call path enforcement instructions in a compiled application, the instructions comprising:
embedding instructions throughout the computer code wherein the embedded instructions include instructions to:
maintain, during run-time, a first run-time call order for a sequence of function calls and an evolving value associated with the first run-time call order;
transform a subset of function parameters associated with a protected function based on the first run-time call order and the evolving value prior to calling the protected function;
generate a second run-time call order by re-calculating the sequence of function calls inside the protected function; and
un-transform the subset of function parameters based on the second run-time call order and the evolving value inside the protected function.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the computer program is a dynamic-link library.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the predetermined run-time call order includes function calls spanning multiple routines in the computer program.