Automated code lockdown to reduce attack surface for software
In an example embodiment, a system determines a set of instructions from the available instructions for a computer application. The determined set of instructions provides specific functionality of the computer application. The system may determine the set of instructions by performing functional testing and negative testing on the specific functionality. The system may reorganize and randomize the set of instructions in memory and write the reorganized set of instructions to a smaller memory space. For each available instruction not in the set of instructions, the system changes the respective instruction to inoperative to prevent execution of the respective instruction. The system may change the respective instruction to inoperative by overwriting the instruction with a NOP instruction. The system then captures a memory address of the computer application being accessed at runtime. The system may declare a security attack if the captured memory address matches a memory address for an inoperative instruction.
1. A method comprising:
determining a set of instructions from available instructions for a computer application, the computer application being distinct from an operating system kernel, wherein the set of instructions provide specific functionality of the computer application, determining the set of instructions further comprises performing functional testing and negative testing on the specific functionality of the computer application, and the specific functionality is dependent on class of a user executing the computer application;
reorganizing memory addresses for the set of instructions in a manner that retains relative address relationships among the set of instructions, or for one or more available instructions of the computer application not in the set of instructions, changing the one or more respective instructions to inoperative to prevent execution of the one or more respective instructions of the computer application;
capturing a memory address of the computer application being accessed at runtime; and
declaring a security attack if the captured memory address matches a memory address for an inoperative instruction of the computer application, or preventing exploit of a security vulnerability of the computer application if the captured memory address corresponds to a reorganized memory address.
2. The method of claim 1 , wherein determining the set of instructions further comprises:
capturing instructions executed during the functional testing.
3. The method of claim 1 , wherein the negative testing triggers exception handling functions respective to the specific functionality, the method further comprising:
capturing instructions executed by triggering the exception handling functions.
4. The method of claim 2 , further comprising capturing instructs for exception handling functions by statically analyzing structure of threads executing the specific functionality during the functional testing.
5. The method of claim 1 , wherein changing the one of more respective instructions to inoperative is permanent or temporary.
6. The method of claim 1 , wherein changing the one of more respective instructions to inoperative comprises overwriting the one of more respective instructions with inoperative instructions during load time.
7. The method of claim 1 , wherein changing the one of more respective instructions to inoperative comprises overwriting the one of more respective instructions with inoperative instructions during runtime.
8. The method of claim 1 , wherein changing the one of more respective instructions to inoperative comprises overwriting the one of more respective instructions with a NOP instruction.
9. The method of claim 1 , further comprising writing the reorganized set of instructions to a smaller memory space.
10. The method of claim 9 , further comprising randomizing the reorganized set of instructions in memory prior to writing to a smaller memory space.
11. The method of claim 1 , further comprising writing memory addresses for the set of instructions to a table for loading on a hardware processor.
12. The method of claim 1 , wherein the computer application includes at least one of executables and libraries.
13. A system comprising:
at least one hardware processor configured to implement:
an instrumentation engine configured to:
determine a set of instructions from available instructions for a computer application, the computer application being distinct from an operating system kernel, wherein the set of instructions provide specific functionality of the computer application, determining the set of instructions by performing functional testing and negative testing on the specific functionality of the computer application, and the specific functionality is dependent on class of a user executing the computer application;
reorganize memory addresses for the set of instructions in a manner that retains relative address relationships among the set of instructions, or for one or more available instructions of the computer application not in the set of instructions, change the one or more respective instructions to inoperative to prevent execution of the one or more respective instructions of the computer application;
an analysis engine communicatively coupled to the instrumentation engine, the analysis engine configured to: capture a memory address of the computer application being accessed at runtime, or prevent exploit of a security vulnerability of the computer application if the captured memory address corresponds to a reorganized memory address; and
a validation engine communicatively coupled to the analysis engine and the instrumentation engine, the validation engine configured to declare a security attack if the captured memory address matches a memory address for an inoperative instruction of the computer application.
14. The system of claim 13 , wherein the instrumentation engine is further configured to:
capture instructions executed during the functional testing.
15. The system of claim 14 , wherein the instrumentation engine is further configured to capture instructs for exception handling functions by statically analyzing structure of threads executing the specific functionality.
16. The system of claim 13 , wherein the negative testing triggers exception handling functions respective to the specific functionality and the instrumentation engine is further configured to:
capture instructions executed by triggering the exception handling functions.
17. The system of claim 13 , wherein changing the one or more respective instructions to inoperative is permanent or temporary.
18. The system of claim 13 , wherein changing the one or more respective instructions to inoperative comprises overwriting the one or more respective instructions with inoperative instructions during load time.
19. The system of claim 13 , wherein changing the one or more respective instructions to inoperative comprises overwriting the one or more respective instructions with inoperative instructions during runtime.
20. The system of claim 13 , wherein changing the one or more respective instructions to inoperative comprises overwriting the one or more respective instructions with a NOP instruction.
21. The system of claim 13 , wherein the instrumentation engine is further configured to:
write the reorganized set of instructions to a smaller memory space.
22. The system of claim 21 , wherein the instrumentation engine is further configured to:
randomize the reorganized set of instructions in memory prior to writing to a smaller memory space.
23. The system of claim 13 , wherein the instrumentation engine is further configured to:
write memory addresses for the set of instructions to a table for loading on a hardware processor.
24. The system of claim 13 , wherein the computer application includes at least one of executables and libraries.
25. The system of claim 13 , wherein the analysis engine, the instrumentation engine, and the validation engine comprise a processor fabric including one or more hardware processors.