Can I read Towards Integral Binary Execution: Implementing Oblivious Hashing Using Overlapped Instruction Encodings on EtoBox?

Towards Integral Binary Execution: Implementing Oblivious Hashing Using Overlapped Instruction Encodings by Matthias Jacob; Mariusz H. Jakubowski; Ramarathnam Venkatesan is a scholarly article available to read on EtoBox.

What is Towards Integral Binary Execution: Implementing Oblivious Hashing Using Overlapped Instruction Encodings about?

Executing binaries without interference by an outside adversary has been an ongoing duel between protection methods and attacks. Recently, an efficient kernel-patch attack has been presented against commonly used self-checking code techniques that use checksumming ahead of execution. While methods based on self-modifying code can defend against this attack, such techniques depend on low-level architectural details and may not be practical in the long run. An alternative defense is to use oblivious hashing (OH). Instead of checking code integrity prior to execution, OH can verify untampered runtime behavior continuously. However, earlier OH approaches have some weaknesses, particularly with binary code: Physical instruction bytes cannot be easily checked during execution, and an attacker may be able to detect and remove OH checks, since OH alone does not provide tamper-resistance or obfuscation.In our approach, we deliberately overlap a program's basic blocks so that they share instruction bytes. This increases tamperresistance implicitly because malicious modifications affect multiple instructions simultaneously. Also, our scheme facilitates explicit anti-tampering checks via injec

Author

Matthias Jacob; Mariusz H. Jakubowski; Ramarathnam Venkatesan

Publisher

ACM Press

Published

2007

Language

EN