Methods of detection of software exploitation
AssigneeESET, spol. s r.o.
InventorsPawel Mirski, Peter Hlavaty, Peter Kosinar
Life of this patent
Estimating the term…
Abstract
A method for detecting software exploitation broadly comprises the steps of gathering information about processes and threads executing on a computing device, monitoring instructions executed by a thread that is currently running, performing the following steps if a function to create a process or a function to load a library is called, examining a thread information block, determining whether an address included in a stack pointer of the thread is in a range of addresses for a stack specified by the thread information block, and determining whether a first plurality of no-operation instructions is followed by shell code that is followed by a second plurality of no-operation instructions.
Claims16
A non-transitory computer-readable storage medium with an executable program stored thereon for detecting software exploitation, wherein the program instructs a processing element to perform the following steps:
- gathering information about processes and threads executing on a computing device;
- monitoring instructions executed by a thread that is currently running;
- and
- performing the following steps when a function to create a process or a function to load a library is called
- examining a plurality of items on a stack,
- examining a chain of exception handlers, each exception handler including a first address pointing to the next exception handler and a second address pointing to instructions for handling an exception, and
- determining for each exception handler whether the second address is located in an address space for executable code.
A non-transitory computer-readable storage medium with an executable program stored thereon for detecting software exploitation, wherein the program instructs a processing element to perform the following steps:
- gathering information about processes and threads executing on a computing device;
- monitoring instructions executed by a thread that is currently running;
- and
- performing the following steps when a function to create a process or a function to load a library is called
- examining a plurality of items on a stack,
- examining a chain of exception handlers, each exception handler including a first address pointing to the next exception handler and a second address pointing to instructions for handling an exception,
- determining for each exception handler whether the first address is within the stack,
- determining for each exception handler whether the first address points to a previous exception handler, and
- determining for each exception handler whether the second address is located in an address space for executable code.
A computing device for detecting software exploitation, the computing device comprising:
- a processing element coupled to a memory element, wherein the processing element is configured to detect software exploitation by:
- gathering information about processes and threads executing on a computing device;
- monitoring instructions executed by a thread that is currently running;
- and
- performing the following steps when a function to create a process or a function to load a library is called
- examining a plurality of items on a stack,
- examining a chain of exception handlers, each exception handler including a first address pointing to the next exception handler and a second address pointing to instructions for handling an exception, and
- determining for each exception handler whether the second address is located in an address space for executable code.
Dependencies are inferred from the claim text.