# US 11,443,032 B2 · Stack pivot exploit detection and mitigation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,443,032 B2 - Document ID: US11443032B2 - Status: Granted - Kind: B2 - Application number: 17/088,285 - Filed: 2020-11-03 - Published: 2021-02-18 - Granted: 2022-09-13 - Earliest claimed: 2018-04-13 - Assignees: Webroot Inc. - Applicants: Webroot Inc. - Inventors: Andrew Sandoval - Web page: https://patentgrep.com/patent/US11443032B2 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3688: {for test execution, e.g. scheduling of test suites} - G06F 11/0754: {by exceeding limits} - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting exploits. In aspects, various “checkpoints” may be identified in software code. At each checkpoint, the current stack pointer, stack base, and stack limit for each mode of execution may be obtained. The current stack pointer for each mode of execution may be evaluated to determine whether the stack pointer falls within a stack range between the stack base and the stack limit of the respective mode of execution. When the stack pointer is determined to be outside of the expected stack range, a stack pivot exploit is detected and one or more remedial actions may be automatically performed. ## Claims ### Claim 1 A method comprising: determining user mode and kernel mode software checkpoints for a process executing on a computing device; for each determined software checkpoint encountered by the executing process: identifying a current stack pointer and a range of memory for one or more execution modes associated with the process, wherein each of the one or more execution modes is associated with a specific stack memory, wherein the range of memory indicates a valid set of memory addresses between a stack base and a stack limit; evaluating the current stack pointer for each of the one or more execution modes against the corresponding range of memory to determine whether the current stack pointer is within the range of the corresponding range of memory; detecting a stack pivot exploit by determining when the current stack pointer is determined to be outside the range of the stack limit; and responsive to detecting a stack pivot exploit, performing one or more remedial actions. ### Claim 2 (depends on 1) The method of claim 1, further comprising exploit prevention software, wherein the exploit prevention software implements a set of software checkpoints to detect process behavior. ### Claim 3 (depends on 2) The method of claim 2, wherein the software checkpoints include at least two of: process creation events, thread creation events, library file load events, registry access events, file system access events, object manager events, and memory operation events. ### Claim 4 (depends on 1) The method of claim 1, wherein each of the one or more-execution modes includes a kernel mode, a 32-bit mode, and a 64-bit mode. ### Claim 5 (depends on 1) The method of claim 1, wherein the current stack pointer refers to a machine register storing a current top memory address of a current stack, the stack base refers to the lowest memory address currently allocated to the current stack, and the stack limit refers to the highest memory address currently allocated to the current stack. ### Claim 6 (depends on 1) The method of claim 1, wherein identifying the current stack pointer and the range of memory comprises accessing at least one of a thread information block and one or more operating system APIs for determining the range of memory. ### Claim 7 (depends on 1) The method of claim 1, wherein evaluating the current stack pointer against the range of memory comprises using at least one of: a rule set and an evaluation model. ### Claim 8 (depends on 1) The method of claim 1, wherein determining whether the current stack pointer is within the range of the range of memory comprises comparing a memory address of the current stack pointer to a range of memory addresses associated with the range of memory. ### Claim 9 (depends on 1) The method of claim 1, wherein the one or more remedial actions comprise at least one of: displaying a warning, terminating the process, modifying a set of privileges, and quarantining a file associated with the process. ### Claim 10 A system comprising: at least one processor; and memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising: determining user mode and kernel mode software checkpoints for a process executing on a computing device; for each determined software checkpoint encountered by the executing process: identifying a current stack pointer and a range of memory for one or more execution modes associated with the process, wherein each of the one or more execution modes is associated with a specific stack memory, wherein the range of memory indicates a valid set of memory addresses between a stack base and a stack limit; evaluating the current stack pointer for each of the one or more execution modes against the corresponding range of memory to determine whether the current stack pointer is within the corresponding range of memory; detecting a stack pivot exploit by determining when the current stack pointer is determined to be outside the range of memory; and responsive to detecting a stack pivot exploit, performing one or more remedial actions. ### Claim 11 (depends on 10) The system of claim 10, further comprising exploit prevention software, wherein the exploit prevention software implements a set of software checkpoints to detect process behavior. ### Claim 12 (depends on 11) The system of claim 11, wherein the software checkpoints include at least two of: process creation events, thread creation events, library file load events, registry access events, file system access events, object manager events, and memory operation events. ### Claim 13 (depends on 10) The system of claim 10, wherein each of the one or more-execution modes includes a kernel mode, a 32-bit mode, and a 64-bit mode. ### Claim 14 (depends on 10) The system of claim 10, wherein the current stack pointer refers to a register storing a memory address of a last function call made by a thread of execution in a program, and the stack limit refers to the current lowest address of a stack. ### Claim 15 (depends on 10) The system of claim 10, wherein identifying the current stack pointer and the range of memory comprises accessing at least one of a thread information block and one or more operating system APIs for determining the stack base and the stack limit. ### Claim 16 (depends on 10) The system of claim 10, wherein evaluating the current stack pointer against the range of memory comprises using at least one of: a rule set and an evaluation model. ### Claim 17 (depends on 10) The system of claim 10, wherein determining whether the current stack pointer is within the range of the stack limit comprises comparing a memory address of the current stack pointer to a range of memory addresses associated with the range of memory. ### Claim 18 (depends on 10) The system of claim 10, wherein the one or more remedial actions comprise at least one of: displaying a warning, terminating the process, modifying a set of privileges, and quarantining a file associated with the process. ### Claim 19 A non-transitory computer-readable media storing computer executable instructions that when executed cause a computing system to perform a method comprising: determining user mode and kernel mode software checkpoints for a process executing on a computing device; for each determined software checkpoint encountered by the executing process: identifying a current stack pointer and a range of memory for one or more execution modes associated with the process, wherein each of the one or more execution modes is associated with a specific stack memory, wherein the range of memory indicates a valid set of memory addresses between a stack base and a stack limit; evaluating the current stack pointer for each of the one or more execution modes against the corresponding range of memory to determine whether the current stack pointer is within the corresponding range of memory; detecting a stack pivot exploit by determining when the current stack pointer is determined to be outside the range of memory; and responsive to detecting a stack pivot exploit, performing one or more remedial actions. ### Claim 20 (depends on 19) The non-transitory computer-readable media storing computer of claim 19, wherein determining whether the current stack pointer is within the range of memory comprises determining whether a memory address of the current stack pointer matches a memory address within the range of memory.