Open Text Corporation

Webroot Inc.

Ira Strawser

Eric Klonowski

Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting using stack artifact verification. In aspects, function hooks may be added to one or more functions. When a hooked function executes, artifacts relating to the hooked function may be left on the stack memory ('stack'). The location of the artifacts on the stack may be stored in a local storage area. Each time a hook in a hooked function is subsequently executed, protection may be executed to determine whether an artifact remains in the location stored in the local storage area. If the artifact is no longer in the same location, a stack pivot may be detected and one or more remedial actions may be automatically performed.

Detecting stack pivots using stack artifact verification

Examples of the present disclosure describe systems and methods for selective export address table filtering. In aspects, the relative virtual address (RVA) of exported function names may be modified to point to a protected memory location. An exception handler may be registered to process exceptions relating to access violations of the protected memory location. If an exception is detected that indicates an attempt to access the protected memory location, the instruction pointer of the exception may be compared to an allowed range of memory addresses. If the instruction pointer address is outside the boundaries, remedial action may occur.

Selective import/export address table filtering

Examples of the present disclosure describe systems and methods for selective export address table filtering. In aspects, when an executable program is loaded in an operating system's execution environment, an address table filtering (ATF) module is loaded into the address space of a target process associated with the executable program. The ATF module may iterate a list of system library files to identify exported function names. The relative virtual address (RVA) of the exported function names may be modified to point to a protected memory location. An exception handler may be registered to process exceptions relating to access violations of the protected memory location. If the exception handler determines that an access violation caused the detected exception, the instruction pointer of the exception may be compared to the expected system library addresses boundaries. If the instruction pointer address is outside the boundaries, remedial action may occur.

Growing community of inventors

Thorton, CO, United States of America

Ira Strawser