Patent ID: 7765579

Claim:
A method of using binary code translation to introduce a security policy into a program run on a data processor, comprising: a) translating original program code for said program at runtime by adding code to implement said security policy; b) updating an address offset correction table each time code is added to provide a mapping from original program code addresses to relocated addresses in said translated code; c) as each branch is reached, determining whether the branch has a runtime computed branch target, termed a dynamic branch, or a static branch target; d) stopping said translating at the dynamic branches; e) translating branches with static branch targets by replacing the original branch targets with corrected target addresses provided by the address offset correction table; f) continuing said translating at runtime at a dynamic branch where translation was previously stopped when said branch is executed; and g) continuing translating beginning at the target of said dynamic branch by using the original branch target address to lookup a corrected branch target address using said offset correction table; whereby when execution reaches code at said target, the target code is translated to introduce the security policy and branch target addresses are corrected by taking into account the code address changes caused by inserting code at previous addresses.