Method and apparatus for preemptive monitoring of software binaries by instruction interception and dynamic recompilation

Abstract

A method of executing a program in a controlled environment includes initiating execution of an operating system with which the program is adapted to execute, inserting redirection logic at the beginning of the program, and executing the program such that the redirection logic is executed. A current instruction pointer is stored, and execution control is redirected to a program loader. The program loader selects a first block of instructions of the program, based at least in part on the stored current instruction pointer. This selected block of instructions is manipulated to provide a first phantom instruction block, which is executed in the controlled environment. This manipulation includes copying at least a portion of the selected first block to form the first phantom instruction block.

1 . A method of executing a program in a controlled environment, comprising: 
 initiating execution of an operating system with which the program is adapted to execute;    inserting, at a beginning of the program, first redirection logic;    executing the program such that the first redirection logic is executed;    storing a current instruction pointer;    redirecting execution control to a program loader;    selecting, by the program loader, a first block of instructions of the program based at least in part on the stored current instruction pointer;    manipulating the selected first block of instructions to provide a first phantom instruction block; and    executing the first phantom instruction block in the controlled environment;    wherein the selected first block of instructions includes at least one instruction, and manipulating the selected first block includes copying at least a portion of the selected first block to form the first phantom instruction block.    
     
     
         2 . The method of  claim 1 , wherein manipulating the selected first block of instructions further includes at least one of 
 marking the selected first block as read-only, and    logically modifying at least a portion of the first phantom instruction block.    
     
     
         3 . The method of  claim 2 , wherein logically modifying the at least a portion of the first phantom instruction block includes at least one of 
 inserting program logic into the first phantom instruction block,    deleting program logic from the first phantom instruction block, and    changing program logic in the first phantom instruction block.    
     
     
         4 . (canceled)  
     
     
         5 . (canceled)  
     
     
         6 . The method of  claim 1 , wherein the selected first block of instructions includes a plurality of instructions.  
     
     
         7 . The method of  claim 1 , wherein storing a current instruction pointer includes pushing the current instruction pointer onto a stack.  
     
     
         8 . The method of  claim 1 , wherein the acts further comprise: 
 storing a next instruction pointer;    selecting, by the program loader, a second block of instructions of the program based at least in part on the stored next instruction pointer;    manipulating the selected second block of instructions to provide a second phantom instruction block, wherein manipulating the selected second block includes copying at least a portion of the selected second block to form the second phantom instruction block; and    executing the second phantom instruction block in the controlled environment;    wherein the selected second block includes at least one instruction.    
     
     
         9 . The method of  claim 8 , wherein manipulating the selected first and second blocks further include at least one of 
 marking the first and second blocks as read-only, and    logically modifying at least a portion of the first and second phantom instruction blocks.    
     
     
         10 . The method of  claim 9 , wherein logically modifying the at least a portion of the first and second phantom instruction blocks includes at least one of 
 inserting program logic into the first and second phantom instruction blocks,    deleting program logic from the first and second phantom instruction blocks, and    changing program logic in the first and second phantom instruction blocks.    
     
     
         11 . The method of  claim 1 , wherein the operating system includes a thread spawning routine having at least one block of instructions, and said method further comprises: 
 inserting, at a beginning of the thread spawning routine, second redirection logic that directs execution control to the program loader; and    executing the thread spawning routine.    
     
     
         12 . The method of  claim 1 , wherein the operating system includes an exception handling routine having at least one block of instructions, and said method further comprises: 
 inserting, at a beginning of the exception handling routine, second redirection logic that directs execution control to the program loader; and    executing the exception handling routine.    
     
     
         13 . A method of executing, in a controlled environment, a program having at least one block of instructions, comprising: 
 initiating execution of an operating system with which the program is adapted to execute; and    for at least one of the at least one blocks of instructions, performing acts including 
 directing execution control to a program loader,  
 selecting, by the program loader, a block of instructions of the program;  
 manipulating the selected block of instructions to provide a phantom instruction block, and  
 executing the phantom instruction block in the controlled environment;  
   wherein each selected block includes at least one instruction, and manipulating the selected block includes copying at least a portion of the selected block to form the phantom instruction block.    
     
     
         14 . The method of  claim 13 , further comprising halting said acts based on the occurrence of a halt event.  
     
     
         15 . The method of  claim 13 , wherein manipulating the selected block of instructions further includes at least one of 
 marking the selected block as read-only, and    logically modifying at least a portion of the phantom instruction block.    
     
     
         16 . The method of  claim 15 , wherein logically modifying the at least a portion of the phantom instruction block includes at least one of 
 inserting program logic into the phantom instruction block,    deleting program logic from the phantom instruction block, and    changing program logic in the phantom instruction block.    
     
     
         17 . (canceled)  
     
     
         18 . (canceled)  
     
     
         19 . The method of  claim 13 , wherein the method further comprises: 
 inserting, within the program, first redirection logic that directs execution control to the program loader; and    executing the program;    wherein said acts further include storing a respective current instruction pointer, and the program loader selects the block of instructions of the program based at least in part on the stored respective current instruction pointer.    
     
     
         20 . The method of  claim 13 , wherein the operating system includes a thread spawning routine having at least one set of instructions, and said method further comprises: 
 inserting, at a beginning of the thread spawning routine, second redirection logic that directs execution control to the program loader; and    executing the thread spawning routine;    wherein each set of instructions includes at least one instruction.    
     
     
         21 . The method of  claim 20 , further comprising 
 for at least one of the at least one set of instructions, performing actions including 
 redirecting execution control to the program loader,  
 selecting, by the program loader, a set of instructions of the thread spawning routine;  
 manipulating the selected set of instructions to provide a phantom instruction set, and  
 executing the phantom instruction set in the controlled environment;  
   wherein each selected set of instructions includes at least one instruction, and manipulating the selected set of instructions includes copying at least a portion of the selected set of instructions to form the phantom instruction set.    
     
     
         22 . The method of  claim 13 , wherein the operating system includes an exception handling routine having at least one set of instructions, and said method further comprises: 
 inserting, at a beginning of the exception handling routine, second redirection logic that directs execution control to the program loader; and    executing the exception handling routine;    wherein each set of instructions includes at least one instruction.    
     
     
         23 . The method of  claim 22 , further comprising 
 for at least one of the at least one set of instructions, performing actions including 
 redirecting execution control to the program loader,  
 selecting, by the program loader, a set of instructions of the exception handling routine;  
 manipulating the selected set of instructions to provide a phantom instruction set, and  
 executing the phantom instruction set in the controlled environment;  
   wherein each selected set of instructions includes at least one instruction, and manipulating the selected set of instructions includes copying at least a portion of the selected set of instructions to form the phantom instruction set.    
     
     
         24 . The method of  claim 13 , wherein manipulating the selected block of instructions further includes 
 determining if the selected block is represented by current data stored in a cache;    if the selected block is not represented by the current data stored in the cache, 
 copying at least a portion of the selected block to form the phantom instruction block, and  
 adding additional data representative of the formed phantom instruction block to the cache; and  
   if the selected block is represented by the current data stored in the cache, referencing the current data representative of the selected block of instruction to provide the phantom instruction block.    
     
     
         25 . (canceled)