Selective import/export address table filtering
AssigneeOpen Text Corporation
InventorsEric Klonowski, Ira Strawser
Life of this patent
Estimating the term…
Abstract
Examples of the present disclosure describe systems and methods for selective export address table filtering. In aspects, the relative virtual address (RVA) of exported function names may be modified to point to a protected memory location. An exception handler may be registered to process exceptions relating to access violations of the protected memory location. If an exception is detected that indicates an attempt to access the protected memory location, the instruction pointer of the exception may be compared to an allowed range of memory addresses. If the instruction pointer address is outside the boundaries, remedial action may occur.
Claims20
A system comprising:
- one or more processors;
- and
- memory coupled to at least one of the one or more processors, the memory comprising computer executable instructions that, when executed by the one or more processors, performs a method comprising:
- receiving a list of exportable functions accessible to an executing program, the exportable functions each having an exportable function name string;
- referencing a relative virtual address (RVA) of one or more of the list of exportable function name strings in a memory space of the executing program to a protected memory location, wherein the RVA was previously mapped to a different memory location;
- processing a received exception, the received exception occurring in response to attempted access of the protected memory location, wherein the processing comprises determining whether a memory address of the received exception is within an allowed range of memory addresses;
- and
- in response to determining the memory address of the received exception is not within the allowed range of memory addresses, pausing or terminating the executing program.
A method comprising:
- receiving a list of exportable functions accessible to an executing program, the exportable functions each having an exportable function name string;
- referencing a relative virtual address (RVA) of one or more of the list of exportable function name strings in a memory space of the executing program to a protected memory location, wherein the RVA was previously mapped to a different memory location;
- processing a received exception, the received exception occurring in response to attempted access of the protected memory location, wherein the processing comprises determining whether a memory address of the received exception is within an allowed range of memory addresses;
- and
- in response to determining the memory address of the received exception is not within the allowed range of memory addresses, pausing or terminating the executing program.
A computer-readable storage device storing computer executable instructions that when executed cause a computing system to perform a method comprising:
- receiving a list of exportable functions accessible to an executing program, the exportable functions each having an exportable function name strings;
- referencing a relative virtual address (RVA) of one or more of the list of exportable function name strings in a memory space of the executing program to a protected memory location, wherein the RVA was previously mapped to a different memory location;
- processing a received exception, the received exception occurring in response to attempted access of the protected memory location, wherein the processing comprises determining whether a memory address of the received exception is within an allowed range of memory addresses;
- and
- in response to determining the memory address of the received exception is not within the allowed range of memory addresses, pausing or terminating the executing program.
Dependencies are inferred from the claim text.