Method and apparatus for detecting shellcode insertion
AssigneeF-Secure Oyj
InventorsVinay Karecha, Hirosh Joseph
Life of this patent
Estimating the term…
Abstract
A method of detecting malware present on a computer system where the computer system is running an application. The method comprises redirecting a function call, made by the application to a decoding function that performs decoding of an argument provided to it by an application, to a scanning function. The scanning function is then employed to scan an argument of the function call for suspect code or data. In the event that suspect code or data is detected, the function call is inhibited, otherwise program control is returned to the called decoding function.
Claims8
A method of detecting malware present on a computer system where the computer system is running an application, the method comprising:
- redirecting a function call, made by the application to a decoding function that performs decoding of an argument provided to it by an application, to a scanning function;
- employing the scanning function to scan an argument of the function call for suspect code or data;
- and
- in the event that suspect code or data is detected, inhibiting the function call, otherwise returning program control to the called decoding function.
A computer system comprising:
- a first processing function for redirecting a call, made by the application to a decoding function that performs decoding of an argument provided to it by an application, to a scanning function;
- a second processing function for employing the scanning function to scan an argument of the function call for suspect code or data;
- and
- a third processing function for inhibiting the function call in the event that suspect code or data is detected, and for otherwise returning program control to the called decoding function.
A computer readable memory storing a computer program which when executed by at least one processor causes a computer system to:
- redirect a function call, made by an application to a decoding function that performs decoding of an argument provided to it by an application, to a scanning function;
- employ the scanning function to scan an argument of the function call for suspect code or data;
- and
- in the event that suspect code or data is detected, inhibit the function call, otherwise return program control to the called decoding function
Dependencies are inferred from the claim text.