US 12,223,040 B2 · Blocking routine redirection

Abstract

Disclosed herein are methods, systems, and computer-readable media for blocking attempts at runtime redirection and attempts to change memory permissions during runtime. The present disclosure describes features that enable runtime detection of an attempt to redirect routines or change memory permissions, and determining whether to allow or deny the attempt. Such features may include changing memory write permissions on memory segments, such as those segments used by dynamic loaders after call associations have been saved or otherwise created. Other features may include swapping the addresses of system routines (e.g., open, read, write, close, etc.) to new routines that perform the same function as well as additional functionality configured to detect attempts to redirect or change memory permissions. Once detected by the new routine during runtime, a determination may be made to deny or allow the call based on a policy.

Claims20

Dependent claims

A method comprising:

enabling detection of a redirection of data being attempted by a call by changing one or more memory permissions of a virtual file system, the call including at least one change to a memory permission of the virtual file system;
detecting, by use of executable code that is executed in response to the call being received, that the call is attempting to redirect data based on an attempt to perform the at least one change to the memory permission of the file system;
and
denying the at least one change to the memory permission of the file system;
wherein enabling detection of the redirection comprises:
identifying one or more first system routines that read or write memory permissions associated with the virtual file system;
identifying one or more memory locations of the one or more first system routines;
and
exchanging the one or more memory locations with one or more memory locations of one or more second routines, wherein respective ones of the second routines each comprise code that performs the functions of respective ones of the first routines and additional code that detects the redirection of the data.

6 more elements

One or more non-transitory computer-readable media storing executable instructions that, when executed, cause an apparatus to:

enable detection of a redirection of data being attempted by a call by changing one or more memory permissions of a file system, the call including at least one change to a memory permission of the file system;
detect, by use of executable code that is executed in response to the call being received, that the call is attempting to redirect data based on an attempt to perform the at least one change to the memory permission of the file system;
and
deny the at least one change to the memory permission of the file system;
wherein the instructions that cause the apparatus to enable detection of the redirection comprise instructions for:
identifying one or more first system routines that read or write memory permissions associated with the virtual file system;
identifying one or more memory locations of the one or more first system routines;
and
exchanging the one or more memory locations with one or more memory locations of one or more second routines, wherein respective ones of the second routines each comprise code that performs the functions of respective ones of the first routines and additional code that detects the redirection of the data.

6 more elements

Dependencies are inferred from the claim text.

Blocking routine redirection

Life of this patent

Blocking routine redirection

Life of this patent

Abstract

Claims20