Microsoft Technology Licensing, LLC

Richard M Shupak

Louis Lafreniere

Nathan P Myhrvold

Gideon Andreas Yuval

Keith R Vogel

Philip Lucido

Jonathan E Caves

Robert I Davidson

Tim William Burrell

Norman Eugene Apperson

Landy Wang

Michael V Sliger

Thomas Dee McGuire

Bryan William Tuttle

Simon M Meacham

Brandon R Bray

Pat Styles

Barbara L Kess

Daniel R Spalding

Qinlin Tang

Gurbakshish S Rana

Attempts to make code secure often are associated with performance penalties. To facilitate striking an acceptable balance between performance and security, vulnerable areas of source code are identified. The vulnerable areas are examined for areas that are actually safe and the safe areas are filtered from the universe of code that receives security mitigations. The remaining code receives security mitigations appropriate to the level of risk of the code.

Code property analysis for security mitigations

Aspects of the present invention are directed at centrally managing the allocation of memory to executable images in a way that inhibits malware from identifying the location of the executable image. Moreover, performance improvements are implemented over traditional systems that enable relative addressed instruction to be resolved at runtime. In this regard, a method is provided that identifies a randomized location to load the executable image into a memory address space. Then, data that may be used to resolve the relative addressed instruction is loaded and maintained in memory. At runtime when pages that store relative addressed instructions are accessed, an arithmetic operation is performed to resolve the relative addressed instruction. As a result, only those relative addressed instructions on pages accessed during program execution are resolved.

Safe and efficient allocation of memory

Security mechanisms detect and intervene in a malicious attack against a runtime function, even in the presence of a coding flaw such as a buffer overrun or overflow. One such exemplary mechanism uses a predetermined security list of the valid targets for a first runtime function (such as longjmp). For every call to a second runtime function (e.g., setjmp) that prepares for a later invocation of the first runtime function, the dispatcher finds and stores a reference to this list. When a subsequent attack targets the runtime functions by creating an attacker-provided setjmp target address (e.g., the attack overwrites the longjmp target address so that the pointer points somewhere else, such as code provided by the attacker or code that already exists that will eventually pass control to code provided by the attacker), the new (attacker provided) target address is compared to a reference list of the real (valid) target addresses. The list of real target addresses is stored in memory. If the target address that has been provided is found on the reference list, then the runtime function (e.g., longjmp) is allowed to continue to execute by the dispatcher (which may be the actual runtime function). Otherwise, the dispatcher assumes the application is under attack and terminates the process' execution.

Protection against runtime function attacks

Safe exceptions detect and intervene in a malicious attack against an application or system component, even in the presence of a coding flaw such as a buffer overrun. A list of all the exception handlers in an image (e.g., a DLL or EXE) is desirably created. When loading the image into a process, the operating system loader finds and stores a reference to this list. When a subsequent attack targets exception handling by creating an attacker provided exception handler, the new attacker provided exception handler is compared to a list of the real exception handlers. The list of real exception handlers is stored in memory, and desirably cannot be modified. In particular, when an exception occurs, the operating system finds the proper exception handler from information on the stack (this may be under attack, so the information is not trusted) and compares it to the previously created read-only reference list. If the exception handler that has occurred is found on the reference list, the exception handler is allowed to execute. Otherwise, the operating system assumes the application is under attack and terminates the process' execution.

Safe exceptions

A method instruments a function in an executable file so that the instrumented function calls a generic preprocessor prior to execution of the body of the function. After the preprocessor modifies the original function's incoming parameters, the body of the function itself is executed. Finally, execution is directed to a generic postprocessor prior to returning from the function. The postprocessor modifies the outgoing parameters and return value. In one implementation, the parameters of an instrumented function are described and packaged into a descriptor data structure. The descriptor data structure is passed to the generic preprocessor and postprocessor. A generic processor uses the descriptor to select changed behaviors based on the calling context.

Generic wrapper scheme

This present invention extends the mechanism for locating solution access information and then obtaining and implementing the correct solution for updating software programs. The user can communicate with one system on the network, tell it what the user is interested in, and then the system replies on a file by file basis where to locate the desired information. Thus, the user no longer has to register, e.g. in the environment variables, the individual paths for where a multitude of different applications find their additional related information on the network. According to the teachings of the present invention, a user will have to make basically zero changes to the system, and instead will automatically discover the name location of a server that is going to provide the user with the information associated with any user executable file. In particular, one embodiment of the present invention includes a computer implemented method. The method includes querying a first server for a location of a second server containing information associated with a local file. The method further includes querying the second server for the information associated with the local file. The second server then provides the information associated with the executable. Other systems and methods are included within the scope of the present invention.

Information location service

An annotation source representation is supported by a compiler and/or linker to annotate program code, so that analysis tools, such as debuggers and profilers, have more information with which to analyze an executable program. The annotation source representation in the source code is compiled into annotation information so that the annotation remains in the executable code, but is not executed. The annotation information in the executable program is associated with the code that the annotation function is associated with. The present invention eliminates the need of parallel/companion input command files, eliminates the need of compiling a special version of the executable program for purposes of analysis, and eliminates the need of implementing debug statements in the source code.

Debug annotations

A data compressor uses data known to exist on a destination computer for compressing an input data stream by encoding portions of the input data stream as references to matching portions of the known data. The known data is preprocessed to better correlate with the input data stream. The preprocessing includes identifying and modifying internal references in the known data, such as relative offsets and addresses of jump and call instructions in executable code or cross references and hyperlinks in documents. The preprocessing is driven by generating a set of data that describes specific individual modifications or alternatively indicates relationships between the known data and the input data stream, such as code or data block motion, from which individual modifications can be deterministically made. This generated descriptive data is included with the compressed data stream so that identical preprocessing can be applied to the known data at the destination computer based on the generated descriptive data prior to decompression. Preprocessing the known data improves compression of the input data stream since changed internal references that interrupt matches of the input data stream to the known data can be eliminated.

Preprocessing a reference data stream for patch generation and compression

The present invention provides a method and system for determining an optimal placement order for basic blocks within a computer program to improve locality of reference and reduce the working set of the computer program. By reducing the working set, the computer program requires less memory than it normally would require to execute on a computer system. The optimal placement order for basic blocks within a computer program reflects the concurrency of usage for basic blocks during execution of the computer program. The method for determining an optimal placement order includes analyzing the computer program to identify all of the basic blocks, determining how many times each basic block is executed, assigning a placement order to each basic block depending upon how many times each basic block was executed, and reordering the basic blocks according to their assigned placement orders to produce an optimized computer program. The method used to identify all of the basic blocks includes disassembling known instruction addresses to identify the beginning and end of basic blocks and processing jump tables to identify more instruction addresses. Processing jump tables includes processing the first entry of every jump table before processing the second entry of any jump table. The present invention further optimizes a computer program by replacing rarely executed instructions with other instructions that require a smaller amount of storage space.

Growing community of inventors

Bellevue, WA, United States of America

Richard M Shupak