Systems and methods for hypervisor-based protection of code

1. A method for protecting computer code comprising:

obtaining an input file comprising code representing executable files including at least one vulnerable function selected to be encrypted;

encrypting each said at least one vulnerable function;

replacing an unencrypted version of each said at least one vulnerable function of the input file with a Virtual Machine exit (VM-exit) generating instruction, thereby generating a protected executable file;

generating a database file including an encrypted version of each said at least one vulnerable function;

storing a decryption key on a local memory of a target device, said decryption key characterized by being accessible to only a first requesting function;

storing said database file on a local memory of said target device;

executing a Unified Extensible Firmware Interface (UEFI) application on said target device:

said Unified Extensible Firmware Interface (UEFI) application initializing a hypervisor;

said hypervisor accessing said decryption key;

said Unified Extensible Firmware Interface (UEFI) application loading an operating system of said target device;

said operating system executing said executable files;

said hypervisor detecting an attempt to execute said encrypted version of a vulnerable function;

said hypervisor decrypting said encrypted version of said vulnerable function;

said hypervisor protecting a decrypted version of said vulnerable function;

said hypervisor executing said vulnerable function; and

said hypervisor deleting said decrypted version of said vulnerable function,

wherein the step of storing a decryption key on a local memory of said target device comprises encrypting said decryption key using a trusted platform module (TPM).

2. The method for protecting computer code of claim 1 wherein the step of said hypervisor accessing said decryption key comprises said TPM unsealing said decryption key.

3. The method for protecting computer code of claim 2 wherein the step of said TPM unsealing said decryption key further comprises said TPM transitioning to an inaccessible state such that the decryption key is indecipherable.

4. The method for protecting computer code of claim 1 further comprising said Unified Extensible Firmware Interface (UEFI) application communicating with said TPM over a secure channel.

5. A method for protecting computer code comprising:

obtaining an input file comprising code representing executable files including at least one vulnerable function selected to be encrypted;

encrypting each said at least one vulnerable function;

replacing an unencrypted version of each said at least one vulnerable function of the input file with a Virtual Machine exit (VM-exit) generating instruction, thereby generating a protected executable file;

generating a database file including an encrypted version of each said at least one vulnerable function;

storing a decryption key on a local memory of a target device, said decryption key characterized by being accessible to only a first requesting function;

storing said database file on a local memory of said target device;

executing a Unified Extensible Firmware Interface (UEFI) application on said target device:

said Unified Extensible Firmware Interface (UEFI) application initializing a hypervisor;

said hypervisor accessing said decryption key;

said Unified Extensible Firmware Interface (UEFI) application loading an operating system of said target device;

said operating system executing said executable files;

said hypervisor detecting an attempt to execute said encrypted version of a vulnerable function;

said hypervisor decrypting said encrypted version of said vulnerable function;

said hypervisor protecting a decrypted version of said vulnerable function;

said hypervisor executing said vulnerable function; and

said hypervisor deleting said decrypted version of said vulnerable function,

wherein the step of executing said Unified Extensible Firmware Interface (UEFI) application on said target device comprises:

allocating at least one persistent memory block;

setting up secondary level address translation table mapping apparent operating system perceived addresses to real physical addresses; and

setting up an input-output memory management unit mapping apparent hardware device perceived system addresses to real physical addresses.

6. The method for protecting computer code of claim 5 further comprising said secondary level address translation table mapping the hypervisor address space and the operating system address space to different groups of cache sets.

7. The method for protecting computer code of claim 5 further comprising said input-output memory management unit mapping the hypervisor address space and the operating system address space to different groups of cache sets.

8. The method for protecting computer code of claim 5 further comprising said secondary level address translation table assigning access rights to said real physical addresses.

9. The method for protecting computer code of claim 5 further comprising said input-output memory management unit assigning access rights to said real physical addresses.

10. The method for protecting computer code of claim 5 wherein said secondary level address translation table comprises an extended page table.