Qualcomm Incorporated

Daniel Komaromy

Anand Palanigounder

Brian Marc Rosenberg

Arun Balakrishnan

Renwei Ge

Gregory Gordon Rose

Alexander Gantman

Yinian Mao

Alex Gantman

Brian M Rosenberg

Methods, devices, and systems for detecting return-oriented programming (ROP) exploits are disclosed. A system includes a processor, a main memory, and a cache memory. A cache monitor develops an instruction loading profile by monitoring accesses to cached instructions found in the cache memory and misses to instructions not currently in the cache memory. A remedial action unit terminates execution of one or more of the valid code sequences if the instruction loading profile is indicative of execution of an ROP exploit involving one or more valid code sequences. The instruction loading profile may be a hit/miss ratio derived from monitoring cache hits relative to cache misses. The ROP exploits may include code snippets that each include an executable instruction and a return instruction from valid code sequences.

Methods, devices, and systems for detecting return oriented programming exploits

Methods, devices, and systems for detecting return-oriented programming exploits

A method, apparatus, and/or system for execution prevention is provided. A state indicator for a first subset of a plurality of memory pages of executable code in a memory device is set to a non-executable state. A state indicator for a second subset of the plurality of memory pages is set to an executable state, where the second subset of the plurality of memory pages includes indirection stubs to functions in the first subset of the plurality of memory pages. Upon execution of an application, a function call is directed to a corresponding indirection stub in the second subset of the plurality of memory pages which modifies the state indicator for a corresponding function in the first subset of the plurality of memory pages prior to directing execution of the called function from the first subset of the plurality of memory pages.

Dynamic execution prevention to inhibit return-oriented programming

Growing community of inventors

San Diego, CA, United States of America

Daniel Komaromy