Microsoft Technology Licensing, LLC

Ben Niu

Weidong Cui

Xinyang Ge

Ling Tony Chen

Kenneth Dean Johnson

Jason Lin

Gregory John Colombo

Darek Josip Mihocka

Jon Robert Berry

Pedro Miguel Sequeira De Justo Teixeira

Clarence Siu Yeen Dang

James David Cleary

Russell Charles Hadley

YongKang Zhu

Pavlo Lebedynskiy

Tiansheng Tan

Baris Can Cengiz Kasikci

Ruoyu Wang

Insu Yun

Theodore Maxwell Thomas

This disclosure describes systems and methods for protecting commercial off-the-shelf software program code from piracy. A software program may include an executable file. The executable file may include code and data. A platform may modify the executable file such that the data may be placed at a location in memory not based on a fixed distance from the code. The platform may modify the executable file to indicate that the code should be loaded in a hardware enclave and at least a portion of the data should be loaded in the memory outside the hardware enclave. The platform may encrypt the code and provide it to a computing device.

Protecting commercial off-the-shelf program binaries from piracy using hardware enclaves

This disclosure describes systems and methods for protecting commercial off-the-shelf software program code from piracy. A software program may include an executable file having code and data. A platform may modify the executable file such that the data may be placed at a location in memory that is an arbitrary distance from the code. The platform may modify the executable file to include a separation header. The separation header may indicate that the data can be placed at an arbitrary distance in the memory from the code. The separation header may indicate that the code should be loaded into a hardware enclave and that the data should be loaded outside of the hardware enclave. The platform may encrypt the code and provide it to a computing device. The computing device may load the encrypted code into the hardware enclave but load the data into memory outside the hardware enclave.

A program is executed using a call stack and shadow stack. The call stack includes frames having respective return addresses. The frames may also store variables and/or parameters. The shadow stack stores duplicates of the return addresses in the call stack. The call stack and the shadow stack are maintained by, (i) each time a function is called, adding a corresponding stack frame to the call stack and adding a corresponding return address to the shadow stack, and (ii) each time a function is exited, removing a corresponding frame from the call stack and removing a corresponding return address from the shadow stack. A backtrace of the program's current call chain is generated by accessing the return addresses in the shadow stack. The outputted backtrace includes the return addresses from the shadow stack and/or information about the traced functions that is derived from the shadow stack's return addresses.

Stack traces using shadow stack

This disclosure describes systems and methods for protecting commercial off-the-shelf software program code from piracy. A software program may include multiple image files having code and data. A platform may modify the executable file such that the data may be placed at a location in memory that is an arbitrary distance from the code. The platform may encrypt the code and provide it to a computing device comprising a hardware enclave. The computing device may load the encrypted code into the hardware enclave but load the data into memory outside the hardware enclave. The computing device may request a decryption key from an authentication server using a hash of the hardware enclave signed by a processor. The authentication server may provide the decryption key if it verifies the signature and the hash. The computing device may decrypt the code and mark the hardware enclave as non-readable.

A hybrid binary executable under both native processes and compatibility (e.g., emulated) processes. When the hybrid binary is loaded by a native process, the process executes a native code stream contained in the binary directly on a processor. When the hybrid binary is loaded by a compatibility process, the process executes an emulation-compatible (EC) code stream directly on a processor. When executing in a compatibility process, the EC code stream can interact with a foreign code stream that executes in an emulator. The foreign code stream can be included in the hybrid binary itself, or can be external to the hybrid binary. The hybrid binary format supports folding of code between the native code stream and the EC code stream. The hybrid binary comprises a set of memory transformations which are applied to image data obtained from the binary when the hybrid binary executes under the compatibility process.

Hybrid binaries supporting code stream folding

Debugging systems are configured to resolve both memory aliasing conditions in which a write instruction is directed to an unknown destination address, and concurrency conditions in which control flow information is collected for multiple, concurrently executing threads. Recorded state values corresponding to an application's prior execution and control flow information are both obtained.

Reverse debugging of software failures

Growing community of inventors

Bellevue, WA, United States of America

Ben Niu