Back to results
US 11,599,634 B1Granted
System and methods for run time detection and correction of memory corruption
AssigneeVirsec Systems, Inc.
InventorsSatya V. Gupta, Prashant Shenoy
Life of this patent
Estimating the term…
Abstract
A method or apparatus detects a memory corruption of at least one portion of memory during run-time and corrects the memory corruption of the at least one portion of memory by replacing the at least one portion of memory with a backup of the at least one portion of memory. In this way, memory corruption can be corrected in a timely fashion while minimizing security risks.
Claims9
A method comprising:
- detecting an application layer memory corruption of a return address control section of a stack, wherein detecting includes:
- (a) intercepting a first instruction, of a set of instructions to be executed, in response to calling a function, the intercepting of the first instruction includes capturing a shadow copy of a calling address of the called function and executing the intercepted first instruction, the intercepting of the first instruction being performed by a first interrupt instruction that is stored in a list in memory as mapping to the first instruction, wherein (i) the list in the memory mapping the first interrupt instruction to the first instruction causes the first interrupt instruction to be instrumented to temporarily replace the first instruction and (ii) the list in the memory indicates a type of the first instruction, where the indicated type of the first instruction in the list causes the capturing;
- (b) intercepting a second instruction, of the set of instructions to be executed, in response to reaching a return of the called function, the intercepting of the second instruction includes checking a current return address of the called function against the shadow copy of the calling address, the intercepting of the second instruction being performed by a second interrupt instruction that is stored in the list in the memory as mapping to the second instruction, wherein (i) the list in the memory mapping the second interrupt instruction to the second instruction causes the second interrupt instruction to be instrumented to replace the second instruction and (ii) the list in the memory indicates a type of the second instruction, where the indicated type of the second instruction in the list causes the checking;
- and
- (c) declaring the application layer memory corruption based on the checked current return address and the shadow copy of the calling address not matching;
- and
- reporting the application layer memory corruption to a user.
4 more elements
An apparatus comprising:
- a processor configured to execute a process, the process configured to:
- detect an application layer memory corruption of a return address control section of a stack, wherein detecting includes:
- (a) intercepting a first instruction, of a set of instructions to be executed, in response to calling a function, the intercepting of the first instruction includes capturing a shadow copy of a calling address of the called function and executing the intercepted first instruction, the intercepting of the first instruction being performed by a first interrupt instruction that is stored in a list in memory as mapping to the first instruction, wherein (i) the list in the memory mapping the first interrupt instruction to the first instruction causes the first interrupt instruction to be instrumented to temporarily replace the first instruction and (ii) the list in the memory indicates a type of the first instruction, where the indicated type of the first instruction in the list causes the capturing;
- (b) intercepting a second instruction, of the set of instructions to be executed, in response to reaching a return of the called function, the intercepting of the second instruction includes checking a current return address of the called function against the shadow copy of the calling address, the intercepting of the second instruction being performed by a second interrupt instruction that is stored in the list in the memory as mapping to the second instruction, wherein (i) the list in the memory mapping the second interrupt instruction to the second instruction causes the second interrupt instruction to be instrumented to replace the second instruction and (ii) the list in the memory indicates a type of the second instruction, where the indicated type of the second instruction in the list causes the checking;
- and
- (c) declaring the application layer memory corruption based on the checked current return address and the shadow copy of the calling address not matching;
- and
- report the application layer memory corruption to a user.
5 more elements
A computer program product comprising:
- a non-transitory computer-readable storage medium having code instructions stored thereon, the storage medium operatively coupled to a processor, such that, when executed by the processor, the computer code instructions cause the processor to:
- detect an application layer memory corruption of a return address control section of a stack, wherein detecting includes:
- (a) intercepting a first instruction, of a set of instructions to be executed, in response to calling a function, the intercepting of the first instruction includes capturing a shadow copy of a calling address of the called function and executing the intercepted first instruction, the intercepting of the first instruction being performed by a first interrupt instruction that is stored in a list in memory as mapping to the first instruction, wherein (i) the list in the memory mapping the first interrupt instruction to the first instruction causes the first interrupt instruction to be instrumented to temporarily replace the first instruction and (ii) the list in the memory indicates a type of the first instruction, where the indicated type of the first instruction in the list causes the capturing;
- (b) intercepting a second instruction, of the set of instructions to be executed, in response to reaching a return of the called function, the intercepting of the second instruction includes checking a current return address of the called function against the shadow copy of the calling address, the intercepting of the second instruction being performed by a second interrupt instruction that is stored in the list in the memory as mapping to the second instruction, wherein (i) the list in the memory mapping the second interrupt instruction to the second instruction causes the second interrupt instruction to be instrumented to replace the second instruction and (ii) the list in the memory indicates a type of the second instruction, where the indicated type of the second instruction in the list causes the checking;
- and
- (c) declaring the application layer memory corruption based on the checked current return address and the shadow copy of the calling address not matching;
- and
- report the application layer memory corruption to a user.
5 more elements
Dependencies are inferred from the claim text.