Abstract: Aspects of the present invention are directed at centrally managing the allocation of memory to executable images in a way that inhibits malware from identifying the location of the executable image. Moreover, performance improvements are implemented over traditional systems that enable relative addressed instruction to be resolved at runtime. In this regard, a method is provided that identifies a randomized location to load the executable image into a memory address space. Then, data that may be used to resolve the relative addressed instruction is loaded and maintained in memory. At runtime when pages that store relative addressed instructions are accessed, an arithmetic operation is performed to resolve the relative addressed instruction. As a result, only those relative addressed instructions on pages accessed during program execution are resolved.

Abstract: Aspects of the present invention are directed at centrally managing the allocation of memory to executable images in a way that inhibits malware from identifying the location of the executable image. Moreover, performance improvements are implemented over traditional systems that enable relative addressed instruction to be resolved at runtime. In this regard, a method is provided that identifies a randomized location to load the executable image into a memory address space. Then, data that may be used to resolve the relative addressed instruction is loaded and maintained in memory. At runtime when pages that store relative addressed instructions are accessed, an arithmetic operation is performed to resolve the relative addressed instruction. As a result, only those relative addressed instructions on pages accessed during program execution are resolved.

Abstract: A method instruments a function in an executable file so that the instrumented function calls a generic preprocessor prior to execution of the body of the function. After the preprocessor modifies the original function's incoming parameters, the body of the function itself is executed. Finally, execution is directed to a generic postprocessor prior to returning from the function. The postprocessor modifies the outgoing parameters and return value. In one implementation, the parameters of an instrumented function are described and packaged into a descriptor data structure. The descriptor data structure is passed to the generic preprocessor and postprocessor. A generic processor uses the descriptor to select changed behaviors based on the calling context.

Abstract: Security mechanisms detect and intervene in a malicious attack against a runtime function, even in the presence of a coding flaw such as a buffer overrun or overflow. One such exemplary mechanism uses a predetermined security list of the valid targets for a first runtime function (such as longjmp). For every call to a second runtime function (e.g., setjmp) that prepares for a later invocation of the first runtime function, the dispatcher finds and stores a reference to this list. When a subsequent attack targets the runtime functions by creating an attacker-provided setjmp target address (e.g., the attack overwrites the longjmp target address so that the pointer points somewhere else, such as code provided by the attacker or code that already exists that will eventually pass control to code provided by the attacker), the new (attacker provided) target address is compared to a reference list of the real (valid) target addresses. The list of real target addresses is stored in memory.

Abstract: A method instruments a function in an executable file so that the instrumented function calls a generic preprocessor prior to execution of the body of the function. After the preprocessor modifies the original function's incoming parameters, the body of the function itself is executed. Finally, execution is directed to a generic postprocessor prior to returning from the function. The postprocessor modifies the outgoing parameters and return value. In one implementation, the parameters of an instrumented function are described and packaged into a descriptor data structure. The descriptor data structure is passed to the generic preprocessor and postprocessor. A generic processor uses the descriptor to select changed behaviors based on the calling context.

Abstract: The present invention provides a method and system for determining an optimal placement order for basic blocks within a computer program to improve locality of reference and reduce the working set of the computer program. By reducing the working set, the computer program requires less memory than it normally would require to execute on a computer system. The optimal placement order for basic blocks within a computer program reflects the concurrency of usage for basic blocks during execution of the computer program. The method for determining an optimal placement order includes analyzing the computer program to identify all of the basic blocks, determining how many times each basic block is executed, assigning a placement order to each basic block depending upon how many times each basic block was executed, and reordering the basic blocks according to their assigned placement orders to produce an optimized computer program.

Abstract: The present invention provides a method and system for determining an optimal placement order for basic blocks within a computer program to improve locality of reference and reduce the working set of the computer program. By reducing the working set, the computer program requires less memory than it normally would require to execute on a computer system. The optimal placement order for basic blocks within a computer program reflects the concurrency of usage for basic blocks during execution of the computer program. The method for determining an optimal placement order includes analyzing the computer program to identify all of the basic blocks, determining how many times each basic block is executed, assigning a placement order to each basic block depending upon how many times each basic block was executed, and reordering the basic blocks according to their assigned placement orders to produce an optimized computer program.