Intel Corporation

Mcafee, Inc.

Palanivelrajan Rajan Shanmugavelayutham

Koichi Yamada

Igor G Muttik

Alex Nayshtut

Vadim Sukhomlinov

Carl D Woodward

Yuriy Bulygin

Dmitri Rubakha

Arvind Krishnaswamy

Jennifer Eligius Mankin

Oleksandr Bazhaniuk

Sevin F Varoglu

Sravani Konda

Dima Mirkin

Lior Malka

Ravi L Sahita

Barry E Huntley

Scott Dion Rodgers

Jiwei Lu

Jason M Agron

James D Beaney, Jr

Abhik Sarkar

Ashish Bijlani

Chang Seok Bae

Ashish Venkat

A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection

Various embodiments are generally directed to an apparatus, method and other techniques to determine a valid target address for a branch instruction from information stored in a relocation table, a linkage table, or both, the relocation table and the linkage table associated with a binary file and store the valid target address in a table in memory, the valid target address to validate a target address for a translated portion of a routine of the binary file.

Techniques for enforcing control flow integrity using binary translation

Technologies for partial binary translation on multi-core platforms include a shared translation cache, a binary translation thread scheduler, a global installation thread, and a local translation thread and analysis thread for each processor core. On detection of a hotspot, the thread scheduler first resumes the global thread if suspended, next activates the global thread if a translation cache operation is pending, and last schedules local translation or analysis threads for execution. Translation cache operations are centralized in the global thread and decoupled from analysis and translation. The thread scheduler may execute in a non-preemptive nucleus, and the translation and analysis threads may execute in a preemptive runtime. The global thread may be primarily preemptive with a small non-preemptive nucleus to commit updates to the shared translation cache. The global thread may migrate to any of the processor cores. Forward progress is guaranteed. Other embodiments are described and claimed.

Binary translation for multi-processor and multi-core platforms

This disclosure is directed to a system for system for application program interface (API) monitoring bypass prevention. Operation of an API function may be preserved by generating a binary translation based on the API function native code. The native code may then be protected to prevent API monitoring bypassing. In one embodiment, access permission may be set to non-executable for a memory page in which the native code is stored. Attempts to execute the native code may generate exceptions triggering API monitoring. Alternatively, some or all of a body section of the native code may be replaced with at least one trap instruction that cause exceptions triggering API monitoring or engaging protective measures. Use of the trap instruction may be combined with at least one jump instruction added after a header section of the native code. Execution of the jump instruction may cause execution to be redirected to API monitoring.

Application program interface (API) monitoring bypass

Various embodiments are generally directed to an apparatus, method and other techniques to determine whether a target address of a register for an execution instruction is valid or invalid based on a comparison between the target address and one or more valid target addresses stored in a storage, increase a number of invalid target addresses if the target address is invalid, and determine whether the number of invalid target addresses is greater than an invalid target address threshold. Various embodiments may also include initiating a security measure to prevent a security breach if the number of invalid target addresses is greater than the invalid target address threshold or executing the execution instruction if the number of invalid target addresses is less than or equal to the invalid target address threshold.

Techniques for detecting false positive return-oriented programming attacks

A processor and method are described for managing different privilege levels associated with different types of program code, including binary translation program code. For example, one embodiment of a method comprises entering into one of a plurality of privilege modes responsive to detecting the execution of a corresponding one of a plurality of different types of program code including native executable program code, translated executable program code, and binary translation program code. In one embodiment, the binary translation program code includes sub-components each of which are associated with a different privilege level for improved security.

Method and apparatus for securing a dynamic binary translation system

In an embodiment, a processor includes a binary translation engine to receive a code segment, to generate a binary translation of the code segment, and to store the binary translation in a translation cache, where the binary translation includes at least one policy check routine to be executed during execution of the binary translation on behalf of a security agent. Other embodiments are described and claimed.

Performing security operations using binary translation

This disclosure is directed to binary translator driven program state relocation. In general, a device may protect vulnerable program functions by setting them as non-executable. If an attempt is made to execute a protected program function, the program may trap to a binary translator in the device that may be configured to relocate program state from what has already been established (e.g., on a stack register). Program state may include resources (e.g., memory locations) used by the program during the course of execution. The binary translator may then translate the program into an executable form based on the relocated program state, and may be executed accordingly. Intruding code that attempts to overcome normal program execution and implement hostile operations (e.g., based the program state that is reflected in the stack register) will not function as intended since the relocated program state will cause unexpected results.

Binary translator driven program state relocation

Growing community of inventors

San Jose, CA, United States of America

Palanivelrajan Rajan Shanmugavelayutham