US 2019/0317676 A1 · EXECUTABLE MEMORY PROTECTION

Abstract

Examples of the present disclosure describe systems and methods for executable memory protection. In an example, calls to a memory API may be monitored to identify protection attributes of the associated memory. If software requests access to memory that is both executable and writeable, different protection attributes may be used to limit the availability of memory that is both executable and writeable. Subsequently, if software attempts to access the memory in a way not permitted by the different protection attributes, a resulting memory exception may be evaluated to determine whether to modify the memory protection attributes. In examples, the memory protection attributes may be updated accordingly (e.g., to be made executable but not writeable, writeable but not executable, etc.) and execution of the set of software instructions may resume. Thus, memory that is both executable and writeable may be reduced or eliminated; decreasing the likelihood of exploitation by malicious software.

Claims20

Dependent claims

A system comprising:

at least one processor;
and
memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operations, the set of operations comprising:
generating a hook on a memory application programming interface (API), wherein the hook is associated with the threat processor;
receiving, by a threat processor, an indication from the generated hook, wherein the indication is received in response to a set of software instructions generating a call to the memory API;
based on the received indication, generating stored memory information comprising one or more protection attributes associated with the call to the memory API;
determining whether the one or more protection attributes indicate memory that is executable and writeable;
based on determining the one or more protection attributes indicate memory that is executable and writeable, modifying the one or more protection attributes to generate modified protection attributes;
and
continuing execution of the set of software instructions based on the modified protection attributes.

7 more elements

A method for protecting executable memory, comprising:

registering an exception handler;
receiving, by the threat processor, an indication of a memory exception from the exception handler, wherein the memory exception is associated with a set of software instructions accessing memory associated with one or more current protection attributes;
determining one or more requested protection attributes associated with the memory exception;
determining whether the set of software instructions is permitted access to memory having at least one of the one or more requested protection attributes;
based on determining that the set of software is permitted access to memory having the at least one of the one or more requested protection attributes, modifying the memory associated with the current protection attributes based on the one or more requested protection attributes;
and
continuing execution of the set of software instructions using the memory.

4 more elements

A method for protecting executable memory, comprising:

generating a hook on a memory application programming interface (API), wherein the hook is associated with the threat processor;
receiving, by a threat processor, an indication from the generated hook, wherein the indication is received in response to a set of software instructions generating a call to the memory API;
based on the received indication, generating stored memory information comprising one or more protection attributes associated with the call to the memory API;
determining whether the one or more protection attributes indicate memory that is executable and writeable;
based on determining the one or more protection attributes indicate memory that is executable and writeable, modifying the one or more protection attributes to generate modified protection attributes;
and
continuing execution of the set of software instructions based on the modified protection attributes.

4 more elements

Dependencies are inferred from the claim text.

Executable memory protection

Life of this patent

Executable memory protection

Life of this patent

Abstract

Claims20