Intel Corporation

Mcafee, Inc.

Palanivelra Shanmugavelayutham

Koichi Yamada

Arvind Krishnaswamy

Ravi L Sahita

Jiwei Lu

Jason M Agron

Greg William Dalcher

Various embodiments are generally directed to techniques to detect a return-oriented programming (ROP) attack by verifying target addresses of branch instructions during execution. An apparatus includes a processor component, and a comparison component for execution by the processor component to determine whether there is a matching valid target address for a target address of a branch instruction associated with a translated portion of a routine in a table comprising valid target addresses. Other embodiments are described and claimed.

Techniques for detecting return-oriented programming

Technologies for assembling an execution profile of an event are disclosed. The technologies may include monitoring the event for a branch instruction, generating a callback to a security module upon execution of the branch instruction, filtering the callback according to a plurality of event identifiers, and validating a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction.

Hardware and software execution profiling

Growing community of inventors

San Jose, CA, United States of America

Palanivelra Shanmugavelayutham