US 11,636,197 B2 · Selective import/export address table filtering

Abstract

Examples of the present disclosure describe systems and methods for selective export address table filtering. In aspects, when an executable program is loaded in an operating system's execution environment, an address table filtering (ATF) module is loaded into the address space of a target process associated with the executable program. The ATF module may iterate a list of system library files to identify exported function names. The relative virtual address (RVA) of the exported function names may be modified to point to a protected memory location. An exception handler may be registered to process exceptions relating to access violations of the protected memory location. If the exception handler determines that an access violation caused the detected exception, the instruction pointer of the exception may be compared to the expected system library addresses boundaries. If the instruction pointer address is outside the boundaries, remedial action may occur.

Claims20

Dependent claims

A system comprising:

one or more processors;
and
memory coupled to at least one of the one or more processors, the memory comprising computer executable instructions that, when executed by the one or more processors, performs a method comprising:
scanning for exportable functions accessible to an executing program, the exportable functions having exportable function name strings;
modifying a relative virtual address (RVA) of one or more of the exportable function name strings to point to an access-restricted memory location;
registering an exception handler to process exceptions occurring in response to attempted access of the access-restricted memory location;
and
processing a received exception, wherein the processing comprises determining whether a memory address of the received exception is within an expected address range.

5 more elements

Dependencies are inferred from the claim text.

Selective import/export address table filtering

Life of this patent

Selective import/export address table filtering

Life of this patent

Abstract

Claims20