Stack execution detection in a sandbox environment

A method comprising:

• monitoring emulation of a suspicious program in a sandbox environment hosted by a computing device, including monitoring a value of an instruction pointer, which indicates an address of a register storing an emulated instruction of the suspicious program that is a current instruction being executed;
• determining, based on the address of the register indicated by the instruction pointer, that the suspicious program is attempting to access an executable instruction stored in a stack memory of the sandbox environment;
• pausing the emulation of the suspicious program;
• saving context of the emulation of the suspicious program;
• determining validity of the address of the register indicated by the instruction pointer;
• determining if content of the register at the address is an executable instruction by disassemble a portion of bytes of the instruction to determine that the disassembled portion has a structure of an executable instruction;
• determining whether the suspicious program is containable using one or more safeguards, wherein each safeguard determines whether the suspicious program will cause an event to occur from which the computing device hosting the sandbox environment cannot be protected;
• and
• responsive to determining that the suspicious program is containable using the one or more safeguards,
• restoring the stored context;
• and
• resuming the emulation of the suspicious program that is attempting to access the executable instruction stored at the stack memory of the sandbox environment, wherein the suspicious program is allowed to access the stack memory of the sandbox environment.

A computer system comprising:

• at least one processor;
• and
• a non-transitory computer readable medium comprising stored instructions, the instructions when executed by the at least one processor cause the at least one processor to:
• monitor emulation of a suspicious program in a sandbox environment hosted by a computing device, including monitoring a value of an instruction pointer, which indicates an address of a register storing an emulated instruction of the suspicious program that is a current instruction being executed;
• determine, based on the address of the register indicated by the instruction pointer, that the suspicious program is attempting to access an executable instruction stored in a stack memory of the sandbox environment;
• pause the emulation of the suspicious program;
• save context of the emulation of the suspicious program;
• and
• determine validity of the address of the register indicated by the instruction pointer;
• determine if content of the register at the address is an executable instruction by disassemble a portion of bytes of the instruction to determine that the disassembled portion has a structure of an executable instruction;
• determine whether the suspicious program is containable using one or more safeguards, wherein each safeguard determines whether the suspicious program will cause an event to occur from which the computing device hosting the sandbox environment cannot be protected;
• and
• responsive to determining that the suspicious program is containable using the one or more safeguards,
• restore the stored context;
• and
• resume the emulation of the suspicious program that is attempting to access the executable instruction stored at the stack memory of the sandbox environment, wherein the suspicious program is allowed to access the stack memory of the sandbox environment.