30 results about "Self-modifying code" patented technology

A trace cache for efficient self-modifying code processing enables selective invalidation of entries of the trace cache, advantageously retaining some of the entries in the trace cache even during self-modifying code events. Instructions underlying trace cache entries are monitored for modification in groups, enabling advantageously reduced hardware. Associated with trace cache entries are one or more translation ages, determined when the entry is built by sampling current ages of memory blocks underlying the entry. When the entry is accessed and micro-operations therein are processed, each of the translation ages of the accessed entry are compared with the current ages of the memory blocks underlying the accessed entry. If any of the age comparisons fail, then the micro-operations are aborted and the entry is invalidated. When any portion of a memory block is modified, the current age of the modified memory block is incremented.

A method for handling cache coherency includes allocating a tag when a cache line is not exclusive in a data cache for a store operation, and sending the tag and an exclusive fetch for the line to coherency logic. An invalidation request is sent within a minimum amount of time to an I-cache, preferably only if it has fetched to the line and has not been invalidated since, which request includes an address to be invalidated, the tag, and an indicator specifying the line is for a PSC operation. The method further includes comparing the request address against stored addresses of prefetched instructions, and in response to a match, sending a match indicator and the tag to an LSU, within a maximum amount of time. The match indicator is timed, relative to exclusive data return, such that the LSU can discard prefetched instructions following execution of the store operation that stores to a line subject to an exclusive data return, and for which the match is indicated.

A method, system, and computer program product for managing cache coherency for self-modifying code in an out-of-order execution system are disclosed. A program-store-compare (PSC) tracking manager identifies a set of addresses of pending instructions in an address table that match an address requested to be invalidated by a cache invalidation request. The PSC tracking manager receives a fetch address register identifier associated with a fetch address register for the cache invalidation request. The fetch address register is associated with the set of addresses and is a PSC tracking resource reserved by a load store unit (LSU) to monitor an exclusive fetch for a cache line in a high level cache. The PSC tracking manager determines that the set of entries in an instruction line address table associated with the set of addresses is invalid and instructs the LSU to free the fetch address register.

A partitioning technique utilized by a translator to divide the subject code space into regions, referred to hereafter as partitions, where each partition contains a distinct set of basic blocks of subject code and corresponding target code. The partitioning technique divides the translator's representation of subject code and subject code translations into non-overlapping regions of subject memory. In this manner, when the subject program modifies subject code, only those partitions actually affected by the self-modifying code need be discarded and all translations in unaffected partitions can be kept. This partitioning technique is advantageous in limiting the amount of target code that must be retranslated in response to self-modifying code operation. In another process, the partitioning technique allows multithreaded subject programs that also involve self-modifying code to perform code modification in a thread-safe manner.

A partitioning technique utilized by a translator to divide subject code space into partitions, where each partition contains a distinct set of basic blocks of subject code and corresponding target code. Thus the translator's representation of subject code and subject code translations is divided into non-overlapping regions of subject memory. In this manner, when the subject program modifies subject code, only those partitions actually affected by the self-modifying code need be discarded and all translations in unaffected partitions can be kept. This partitioning technique is advantageous in limiting the amount of target code that must be retranslated in response to self-modifying code operation. In another process, the partitioning technique allows multithreaded subject programs that also involve self-modifying code to perform code modification in a thread-safe manner.

Methods and apparatus for providing support for self-modifying visitor code. The device includes memory, hardware buffers and a processor. The processor is configured to convert the guest code to native code and store the converted native code equivalent to the guest code in a code cache portion of the processor. The processor is also configured to maintain a hardware buffer configured to track a corresponding location of the translated code in the code cache. The hardware buffer is updated based on respective accesses to corresponding locations in memory associated with corresponding locations of the translated code in the code cache. The processor is also configured to execute the request to modify the memory location after accessing the hardware buffer.

The invention belongs to the technical field of software security measurement and evaluation, especially relates to a self-modifying code recognition method based on a hardware simulator. The invention is provided with a marker in the hardware simulator in order to only execute a target executable file by one step and capture a virtual system execute instruction, the information in the process can be executed by using a shadow memory monitoring program, the code which is dynamically released into the memory and is executed can be recognized and executed in the course of program execution, so that data information of the analysis target can be acquired. The data acquisition of the invention is implemented by the simulation hardware, is not executed by placing the malevolence code on a trueCPU, so the actual system can not be affected. The invention adopts the hardware simulator as a dynamic analysis platform, which can improve the transparency between the analysis platform and the code and can effectively defend against the detection of the code.

The invention discloses a self-modifying code detection method and device based on binary translation. The method includes detecting whether the operation indicated by the code to be executed is a write operation during the execution of the local code, wherein the local code includes a code obtained by performing a translation operation on the received instruction; if the code to be executed The operation instructed to be performed is the above-mentioned write operation, then query whether there is a virtual address mapping of the above-mentioned write operation in the instruction page table cache, wherein the above-mentioned virtual address mapping is used to record the page number of the virtual address and the physical address of the above-mentioned received instruction The above-mentioned virtual address mapping obtained in the process of executing the above-mentioned translation operation is stored in the above-mentioned instruction page table cache; if the virtual address mapping of the write operation is found in the instruction page table cache, it is determined that the above-mentioned write operation is a self-translation Modify the code operation. Through the present invention, the efficiency of detection and re-translation of self-modifying codes can be improved.

A system and method of determining memory ownership on a cache line basis for detecting self-modifying code including code with looping instructions. An ownership queue includes multiple entries for determining memory ownership on a cache line basis. An ownership index and a wrap bit are determined for each cache line in the ownership queue, which are provided with each instruction derived from the same cache line. When an instruction is issued for execution, the ownership index provided with the instruction is used to access the corresponding entry in the ownership queue. If the instruction and entry wrap bits do not match, then an overwrite of the cache line is detected. The instruction is marked to invoke a first exception, which is performed when the instruction is ready to retire. The first exception flushes the processor, prevents the instruction from being retired, and re-fetches the instruction to continue processing.

System and method of determining memory ownership on cache line basis for detecting self-modifying code. An ownership queue stores cache line addresses and corresponding ownership indexes. The cache line data is translated into instructions, and each instruction is provided with an ownership index of an associated entry in the ownership queue. Each new cache line address is compared with the destination address of each store instruction, and each destination address, when determined, is compared with each cache line address in the ownership queue. Matching entries are marked as stale, and each instruction derived from a stale entry causes an exception when ready to retire. In this manner, a hit between a cache line and a corresponding store instruction causes an exception. An exception flushes the processor to resolve the potential modified code condition.

The invention discloses a software security testing system and method based on dynamic taint propagation. The system comprises a taint source marking module (108) used for generating a taint source marking rule, a detector module (110) used for generating a detection rule, a self-correction code module (104) used for dynamically tracing each binary command of software to be tested by using a self-correction code technology, an RING3 virtual machine module (106) used for analyzing each binary command of the software to be tested by using an RING3 virtual machine and analyzing the flowing direction of the data carried by the command so as to realize taint propagation, as well as calling the taint source marking rule to mark a taint source and calling the detection rule to detect each binary command of the software to be tested, and a log module (112) used for outputting related information violating the detection rule. The software security testing system and method provided by the invention can be used for improving the detection rate of software and reducing false alarm rate and missed alarm rate.

An apparatus for controlling an execution of a binary code by multiple threads includes a detection unit configured to detect an occurrence of modification of a first part that is a part of a first binary code by a self-modifying code; a specifying unit configured to specify a second part that is a part corresponding to the first part in a second binary code acquired by converting the first binary code, in response to detection of the occurrence of modification of the first part by the self-modifying code; and a correction unit configured to correct the second part such that a specific thread that executes the second part of the second binary code among the multiple threads causes an exception.