30 results about "Self-modifying code" patented technology

A trace cache for efficient self-modifying code processing enables selective invalidation of entries of the trace cache, advantageously retaining some of the entries in the trace cache even during self-modifying code events. Instructions underlying trace cache entries are monitored for modification in groups, enabling advantageously reduced hardware. Associated with trace cache entries are one or more translation ages, determined when the entry is built by sampling current ages of memory blocks underlying the entry. When the entry is accessed and micro-operations therein are processed, each of the translation ages of the accessed entry are compared with the current ages of the memory blocks underlying the accessed entry. If any of the age comparisons fail, then the micro-operations are aborted and the entry is invalidated. When any portion of a memory block is modified, the current age of the modified memory block is incremented.

A method for handling cache coherency includes allocating a tag when a cache line is not exclusive in a data cache for a store operation, and sending the tag and an exclusive fetch for the line to coherency logic. An invalidation request is sent within a minimum amount of time to an I-cache, preferably only if it has fetched to the line and has not been invalidated since, which request includes an address to be invalidated, the tag, and an indicator specifying the line is for a PSC operation. The method further includes comparing the request address against stored addresses of prefetched instructions, and in response to a match, sending a match indicator and the tag to an LSU, within a maximum amount of time. The match indicator is timed, relative to exclusive data return, such that the LSU can discard prefetched instructions following execution of the store operation that stores to a line subject to an exclusive data return, and for which the match is indicated.

The invention belongs to the technical field of software security measurement and evaluation, especially relates to a self-modifying code recognition method based on a hardware simulator. The invention is provided with a marker in the hardware simulator in order to only execute a target executable file by one step and capture a virtual system execute instruction, the information in the process can be executed by using a shadow memory monitoring program, the code which is dynamically released into the memory and is executed can be recognized and executed in the course of program execution, so that data information of the analysis target can be acquired. The data acquisition of the invention is implemented by the simulation hardware, is not executed by placing the malevolence code on a true CPU, so the actual system can not be affected. The invention adopts the hardware simulator as a dynamic analysis platform, which can improve the transparency between the analysis platform and the code and can effectively defend against the detection of the code.

A method, system, and computer program product for managing cache coherency for self-modifying code in an out-of-order execution system are disclosed. A program-store-compare (PSC) tracking manager identifies a set of addresses of pending instructions in an address table that match an address requested to be invalidated by a cache invalidation request. The PSC tracking manager receives a fetch address register identifier associated with a fetch address register for the cache invalidation request. The fetch address register is associated with the set of addresses and is a PSC tracking resource reserved by a load store unit (LSU) to monitor an exclusive fetch for a cache line in a high level cache. The PSC tracking manager determines that the set of entries in an instruction line address table associated with the set of addresses is invalid and instructs the LSU to free the fetch address register.

A system and method are described for detecting and recovering from self-modifying code (SMC) conflicts. In one embodiment, detection is accomplished by accessing the contents of a memory, configured to contain a number of recently executed instructions, to obtain an address. This address is compared to information propagating through a front-end pipeline of an instruction pipeline. The instruction pipeline includes the front-end pipeline to support loading and propagation of information through the instruction pipeline and a back-end pipeline to support execution of instructions along with writeback to the memory. If the address matches the information propagating through the front-end pipeline, a SMC conflict has occurred and at least some of the pipelined information is invalidated.

A partitioning technique utilized by a translator to divide the subject code space into regions, referred to hereafter as partitions, where each partition contains a distinct set of basic blocks of subject code and corresponding target code. The partitioning technique divides the translator's representation of subject code and subject code translations into non-overlapping regions of subject memory. In this manner, when the subject program modifies subject code, only those partitions actually affected by the self-modifying code need be discarded and all translations in unaffected partitions can be kept. This partitioning technique is advantageous in limiting the amount of target code that must be retranslated in response to self-modifying code operation. In another process, the partitioning technique allows multithreaded subject programs that also involve self-modifying code to perform code modification in a thread-safe manner.

A method and apparatus for providing support for self modifying guest code. The apparatus includes a memory, a hardware buffer, and a processor. The processor is configured to convert guest code to native code and store converted native code equivalent of the guest code into a code cache portion of the processor. The processor is further configured to maintain the hardware buffer configured for tracking respective locations of converted code in a code cache. The hardware buffer is updated based a respective access to a respective location in the memory associated with a respective location of converted code in the code cache. The processor is further configured to perform a request to modify a memory location after accessing the hardware buffer.

A locking mechanism for use in a multi-thread environment supporting self-modifying code in which modifications to the code are made at runtime. The locking mechanism having associated helper code accessed by a call from the first instruction address in the code block. The helper code calculating the binary encoding for the call instruction and using an atomic compare and exchange instruction to compare the calculated binary encoding with the actual contents of the first instruction address. Where there is a match, a self loop instruction is written to the first instruction address to lock the specified code block for subsequent threads. The helper code contains instructions to resolve the references in the specified block. The last such instruction is an atomic store operation to replace the self loop instruction at the first instruction address with the appropriate modified instruction.

A partitioning technique utilized by a translator to divide subject code space into partitions, where each partition contains a distinct set of basic blocks of subject code and corresponding target code. Thus the translator's representation of subject code and subject code translations is divided into non-overlapping regions of subject memory. In this manner, when the subject program modifies subject code, only those partitions actually affected by the self-modifying code need be discarded and all translations in unaffected partitions can be kept. This partitioning technique is advantageous in limiting the amount of target code that must be retranslated in response to self-modifying code operation. In another process, the partitioning technique allows multithreaded subject programs that also involve self-modifying code to perform code modification in a thread-safe manner.

An apparatus, system and method are described for tracking in-flight line addresses. Such tracking enables a determination of a self-modifying code (SMC) conflict. In one embodiment, the apparatus comprises a line address buffer and companion logic. The line address buffer contains a first plurality of line addresses. Each line address is associated with a fetched instruction pointer. The comparison logic compares a second plurality of line addresses with an address of an instruction being executed in order to detect an event.

Methods and apparatus for providing support for self-modifying visitor code. The device includes memory, hardware buffers and a processor. The processor is configured to convert the guest code to native code and store the converted native code equivalent to the guest code in a code cache portion of the processor. The processor is also configured to maintain a hardware buffer configured to track a corresponding location of the translated code in the code cache. The hardware buffer is updated based on respective accesses to corresponding locations in memory associated with corresponding locations of the translated code in the code cache. The processor is also configured to execute the request to modify the memory location after accessing the hardware buffer.

The invention belongs to the technical field of software security measurement and evaluation, especially relates to a self-modifying code recognition method based on a hardware simulator. The invention is provided with a marker in the hardware simulator in order to only execute a target executable file by one step and capture a virtual system execute instruction, the information in the process can be executed by using a shadow memory monitoring program, the code which is dynamically released into the memory and is executed can be recognized and executed in the course of program execution, so that data information of the analysis target can be acquired. The data acquisition of the invention is implemented by the simulation hardware, is not executed by placing the malevolence code on a trueCPU, so the actual system can not be affected. The invention adopts the hardware simulator as a dynamic analysis platform, which can improve the transparency between the analysis platform and the code and can effectively defend against the detection of the code.

For use in a processor having separate instruction and data buses, separate instruction and data memories and separate instruction and data units, a mechanism for, and method of, supporting self-modifying code and a digital signal processor incorporating the mechanism or the method. In one embodiment, the mechanism includes: (1) a crosstie bus coupling the instruction bus and the data unit and (2) a request arbiter, coupled between the instruction and data units, that arbitrates requests therefrom for access to the instruction memory.

The invention discloses a self-modifying code detection method and device based on binary translation. The method includes detecting whether the operation indicated by the code to be executed is a write operation during the execution of the local code, wherein the local code includes a code obtained by performing a translation operation on the received instruction; if the code to be executed The operation instructed to be performed is the above-mentioned write operation, then query whether there is a virtual address mapping of the above-mentioned write operation in the instruction page table cache, wherein the above-mentioned virtual address mapping is used to record the page number of the virtual address and the physical address of the above-mentioned received instruction The above-mentioned virtual address mapping obtained in the process of executing the above-mentioned translation operation is stored in the above-mentioned instruction page table cache; if the virtual address mapping of the write operation is found in the instruction page table cache, it is determined that the above-mentioned write operation is a self-translation Modify the code operation. Through the present invention, the efficiency of detection and re-translation of self-modifying codes can be improved.

A system and method of determining memory ownership on a cache line basis for detecting self-modifying code including code with looping instructions. An ownership queue includes multiple entries for determining memory ownership on a cache line basis. An ownership index and a wrap bit are determined for each cache line in the ownership queue, which are provided with each instruction derived from the same cache line. When an instruction is issued for execution, the ownership index provided with the instruction is used to access the corresponding entry in the ownership queue. If the instruction and entry wrap bits do not match, then an overwrite of the cache line is detected. The instruction is marked to invoke a first exception, which is performed when the instruction is ready to retire. The first exception flushes the processor, prevents the instruction from being retired, and re-fetches the instruction to continue processing.

System and method of determining memory ownership on cache line basis for detecting self-modifying code. An ownership queue stores cache line addresses and corresponding ownership indexes. The cache line data is translated into instructions, and each instruction is provided with an ownership index of an associated entry in the ownership queue. Each new cache line address is compared with the destination address of each store instruction, and each destination address, when determined, is compared with each cache line address in the ownership queue. Matching entries are marked as stale, and each instruction derived from a stale entry causes an exception when ready to retire. In this manner, a hit between a cache line and a corresponding store instruction causes an exception. An exception flushes the processor to resolve the potential modified code condition.

A processor that determines memory ownership on a cache line basis for detecting self-modifying code including modification of a cache line with an executing instruction. An ownership index and corresponding cache line address are entered for each cache line into an ownership queue. The ownership index is provided with each instruction derived from the cache line. When the instruction is issued, an executing bit is set in the corresponding entry. When a destination address of a store instruction matches an entry in the ownership queue, the store instruction is marked to invoke an executing exception if the executing bit of the entry is set. When a store instruction that is ready to retire is marked to invoke the executing exception, the store instruction is allowed to retire, the processor is flushed, and the next instruction after the store instruction is re-fetched to continue processing.

The invention discloses a software security testing system and method based on dynamic taint propagation. The system comprises a taint source marking module (108) used for generating a taint source marking rule, a detector module (110) used for generating a detection rule, a self-correction code module (104) used for dynamically tracing each binary command of software to be tested by using a self-correction code technology, an RING3 virtual machine module (106) used for analyzing each binary command of the software to be tested by using an RING3 virtual machine and analyzing the flowing direction of the data carried by the command so as to realize taint propagation, as well as calling the taint source marking rule to mark a taint source and calling the detection rule to detect each binary command of the software to be tested, and a log module (112) used for outputting related information violating the detection rule. The software security testing system and method provided by the invention can be used for improving the detection rate of software and reducing false alarm rate and missed alarm rate.