US 12,001,545 B2 · Detecting stack pivots using stack artifact verification

Abstract

Examples of the present disclosure describe systems and methods for detecting and mitigating stack pivoting using stack artifact verification. In aspects, function hooks may be added to one or more functions. When a hooked function executes, artifacts relating to the hooked function may be left on the stack memory (“stack”). The location of the artifacts on the stack may be stored in a local storage area. Each time a hook in a hooked function is subsequently executed, protection may be executed to determine whether an artifact remains in the location stored in the local storage area. If the artifact is no longer in the same location, a stack pivot may be detected and one or more remedial actions may be automatically performed.

Claims19

Dependent claims

A non-transitory computer-readable media storing computer executable instructions for:

identifying, at a first time, a first location of an artifact in stack memory, wherein stack memory is associated with a plurality of different locations and the first location is one of the plurality of locations, and wherein the first location represents a previously identified location of the artifact associated with that stack memory;
evaluating, at a second time, the stack memory, wherein the evaluation comprises determining the first location of the artifact is not currently found in the stack memory;
and
based on determining the first location is no longer found in the stack memory, performing one or more remedial actions.

1 more element

Dependencies are inferred from the claim text.

Facts

Application

17/700,968Filed 22 Mar 2022 · continuation

Priority

5 Dec 2018

Published

US 2022/0215090 A17 Jul 2022

Granted

4 Jun 2024

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/54
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by adding security routines or objects to programs
G06F 9/546
Interprogram communication: message passing systems or structures, e.g. queues
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action

Family

Application16/210,318Parent of this continuation · filed 5 Dec 2018

US 2022/0215090 A1Pre-grant publication · published 7 Jul 2022

US 11,314,855 B2Parent of this continuation

US 2020/0184069 A1Published application

US 12,001,545 B2This patent

From the US filing history. Foreign family members aren’t listed.

Detecting stack pivots using stack artifact verification

Life of this patent

Detecting stack pivots using stack artifact verification

Life of this patent

Abstract

Claims19