# US 10,310,992 B1 · Mitigation of cyber attacks by pointer obfuscation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,310,992 B1 - Document ID: US10310992B1 - Status: Granted - Kind: B1 - Application number: 15/276,807 - Filed: 2016-09-27 - Granted: 2019-06-04 - Earliest claimed: 2012-08-23 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks Inc. - Inventors: Gal Badishi; Netanel Davidi - Web page: https://patentgrep.com/patent/US10310992B1 ## CPC - G06F 12/1458: {by checking the subject access rights} - G06F 9/44521: {Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading} - G06F 12/1433: {for a module or a part of a module} - G06F 12/1483: {using an access-table, e.g. matrix or list} - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for protecting a computer includes identifying a first pointer in a data structure used by a computer program indicating a first memory address to be accessed, using the pointer, in order to invoke a functionality of the computer. The identified first pointer is replaced with a second pointer indicating a second memory address, different from the first memory address. A security program module traps attempts to access the second memory address during execution of the computer program so as to foil unauthorized access to the functionality of the computer. ## Claims ### Claim 1 A method for protecting a computer when loading a computer program into a memory for execution by the computer, comprising: before execution of the computer program by the computer, identifying a pointer, which points to a first memory address for accessing an operating system function in a data structure created for the computer program, and rewriting the identified pointer in the data structure for the computer program so that the identified pointer points to a second memory address, different from the first memory address, wherein the second memory address is defined with a permission setting which does not allow access, such that any attempt to access the second memory address will raise an exception; and configuring the computer to transfer control to program code that determines whether an access to the second memory address during execution of the computer program is a possible unauthorized access to the functionality of the computer, when the second memory address is accessed during execution of the computer program, wherein determining whether the access to the second memory address is a possible unauthorized access comprises analyzing a source of an attempt to access the second memory address, and upon finding the source to be an authorized operation of the computer, correcting the pointer in the data structure created for the computer program to point to the first memory address, and permitting the authorized operation to resume using the first memory address. ### Claim 2 (depends on 1) The method according to claim 1, and comprising upon finding the source to be unauthorized, blocking access to the functionality. ### Claim 3 (depends on 2) The method according to claim 2, and comprising issuing an alert with respect to the attempt. ### Claim 4 (depends on 1) The method according to claim 1, wherein the second memory address is in a location to which access is not permitted by an operating system of the computer, such that attempts to access the second memory address cause exceptions, which result in the transfer of control during execution of the computer program. ### Claim 5 (depends on 1) The method according to claim 1, wherein the first memory address is a location of a function table of the computer program. ### Claim 6 (depends on 1) The method according to claim 1, wherein the program code that determines comprises a dynamic-link library (DLL), which is configured to be loaded prior to the execution of the computer program. ### Claim 7 Computing apparatus, comprising: a memory, which is configured to store a computer program and data structures associated with the computer program; and a processor, which is coupled to the memory and is configured: before execution of the computer program by the computing apparatus, to identify a pointer, which points to a first memory address for accessing an operating system function in a data structure created for the computer program, and to rewrite the identified pointer in the data structure for the computer program so that the identified pointer points to a second memory address, different from the first memory address, wherein the second memory address is defined with a permission setting which does not allow access, such that any attempt to access the second memory address will raise an exception, and to configure the computing apparatus to transfer control to program code that determines whether an access to the second memory address during execution of the computer program is a possible unauthorized access to the functionality of the computing apparatus, when the second memory address is accessed during execution of the computer program, wherein determining whether the access to the second memory address is a possible unauthorized access comprises analyzing a source of an attempt to access the second memory address, and upon finding the source to be an authorized operation of the computer, correcting the pointer in the data structure created for the computer program to point to the first memory address, and permitting the authorized operation to resume using the first memory address. ### Claim 8 (depends on 7) The apparatus according to claim 7, wherein the program code that determines whether an access to the second memory address is a possible unauthorized access causes the processor upon finding the source to be unauthorized, to block access to the functionality. ### Claim 9 (depends on 8) The apparatus according to claim 8, wherein the program code that determines whether an access to the second memory address is a possible unauthorized access causes the processor to issue an alert with respect to the attempt. ### Claim 10 (depends on 7) The apparatus according to claim 7, wherein the processor is configured to assign the second memory address to be in a location to which access is not permitted by the computing apparatus, such that the attempts to access the second memory address cause exceptions, which result in the transfer of control during execution of the computer program. ### Claim 11 (depends on 7) The apparatus according to claim 7, wherein the first memory address is a location of a function table of the computer program. ### Claim 12 (depends on 7) The apparatus according to claim 7, wherein the program code that determines whether an access to the second memory address is a possible unauthorized access comprises a dynamic-link library (DLL), and wherein the processor configured to load the DLL into the memory when the computer program is loaded into the memory, prior to the execution of the computer program. ### Claim 13 A computer software product, comprising a non-transitory computer-readable medium in which program instructions are stored, which instructions, include: a pointer handling module which when read by a computer, causes the computer to identify before execution of the computer program by the computer, a pointer, which points to a first memory address for accessing an operating system function in a data structure created for the computer program, and to rewrite the identified pointer in the data structure for the computer program so that the identified pointer points to a second memory address, different from the first memory address, wherein the second memory address is defined with a permission setting which does not allow access, such that any attempt to access the second memory address will raise an exception; and a security program module invoked when attempts to access the second memory address during execution of the computer program occur, which when invoked determines whether an access to the second memory address which invoked the security program module is a possible unauthorized access to a functionality of the computer program, when the second memory address is accessed during execution of the computer program, wherein determining whether the access to the second memory address is a possible unauthorized access comprises analyzing a source of an attempt to access the second memory address, and upon finding the source to be an authorized operation of the computer, correcting the pointer in the data structure created for the computer program to point to the first memory address, and permitting the authorized operation to resume using the first memory address. ### Claim 14 (depends on 13) The product according to claim 13, wherein the instructions cause the computer upon finding the source to be unauthorized, to block access to the functionality. ### Claim 15 (depends on 14) The product according to claim 14, wherein the instructions cause the computer to issue an alert with respect to the attempt. ### Claim 16 (depends on 13) The product according to claim 13, wherein the instructions cause the computer to assign the second memory address to be in a location to which access is not permitted by the computer, such that the attempts to access the second memory address cause exceptions, which invoke an exception handler module that calls the security program module. ### Claim 17 (depends on 14) The product according to claim 14, wherein the first memory address is a location of a function table of the computer program. ### Claim 18 (depends on 14) The product according to claim 14, wherein the security program module comprises a dynamic-link library (DLL), which is configured to be loaded prior to the execution of the computer program. ### Claim 19 (depends on 13) The product according to claim 13, wherein the pointer handling module is included in a program module loaded to the memory with the computer program. ### Claim 20 (depends on 19) The product according to claim 19, wherein a classification of the computer program loaded into the memory is determined and the pointer handling module is included with the loaded computer program if the process is classified as potentially vulnerable. ### Claim 21 (depends on 19) The product according to claim 19, wherein the pointer handling module is included in a dynamic-link library (DLL) loaded to the memory with the process. ### Claim 22 (depends on 13) The product according to claim 13, wherein the pointer handling module additionally requests allocation of a memory range to include the second memory address. ### Claim 23 (depends on 22) The product according to claim 22, wherein the allocation request of the pointer handling module for the memory range to include the second memory address is provided to an operating system of the computer as a request of the computer program. ### Claim 24 (depends on 23) The product according to claim 23, wherein the pointer handling module does not request that the memory range be committed. ### Claim 25 (depends on 1) The method according to claim 1, wherein identifying the pointer is performed by a module injected into a process designated to run the computer program. ### Claim 26 (depends on 25) The method according to claim 25, wherein the injected module submits a request to the operating system to reserve a certain range of memory including the second memory address, with permission settings not allowing access to the range.