Guarding module loading for cybersecurity

A system for guarding module loading for cybersecurity of a computing system, the system comprising:

• a hardware computing processor;
• a non-transitory memory having stored thereon computing instructions, executable by the hardware computing processor, to perform operations of a method for guarding module loading for cybersecurity of a computing system, the method comprising:
• establishing an exception handler configured to handle an invalid memory access exception;
• modifying a memory block storing a valid memory address of a protected loader block to store an invalid memory address;
• receiving, by the exception handler, a call responsive to the invalid memory access exception;
• responsive to the received call by the exception handler, determining whether the invalid memory access exception was caused by an attempt to access an invalid memory address of a protected loader block to access the protected loader block;
• responsive to a determination that the invalid memory access exception was caused by an attempt to access an invalid memory address of a protected loader block, determining whether the attempt to access the protected loader block should be authorized;
• responsive to a determination that the attempt to access the protected loader block should be authorized, performing:
• patching a memory block storing the invalid memory address of the protected loader block with a valid memory address of the protected loader block;
• determining whether the authorized attempt to access the protected loader block has been completed;
• and
• responsive to a determination that the authorized attempt to access the protected loader block has been completed, unpatching the memory block previously patched with the valid memory address of the protected loader block to store the invalid memory address again;
• and
• responsive to a determination that the attempt to access the protected loader block should not be authorized, performing:
• notifying a process for performing mitigation of the unauthorized attempt to access the protected loader block.

A method comprising:

• establishing an exception handler configured to handle an invalid memory access exception;
• modifying a memory block storing a valid memory address of a protected loader block to store an invalid memory address;
• receiving, by the exception handler, a call responsive to the invalid memory access exception;
• responsive to the received call by the exception handler, determining whether the invalid memory access exception was caused by an attempt to access an invalid memory address of a protected loader block to access the protected loader block;
• responsive to a determination that the invalid memory access exception was caused by an attempt to access an invalid memory address of a protected loader block, determining whether the attempt to access the protected loader block should be authorized;
• responsive to a determination that the attempt to access the protected loader block should be authorized, performing:
• patching a memory block storing the invalid memory address of the protected loader block with a valid memory address of the protected loader block, the patched memory block disposed within a region of memory associated with a particular process environment block associated with the attempt to access the protected loader block, the particular process environment block associated with a thread environment block also associated with the attempt to access the protected loader block, the patching performed within a thread context associated with the thread environment block and with the attempt to access the protected loader block, and the patching comprising editing the thread context to update a register referencing the invalid memory address with the valid memory address of the protected loader block;
• determining whether the authorized attempt to access the protected loader block has been completed;
• and
• responsive to a determination that the authorized attempt to access the protected loader block has been completed, unpatching the memory block previously patched with the valid memory address of the protected loader block to store the invalid memory address again;
• and
• responsive to a determination that the attempt to access the protected loader block should not be authorized, performing:
• notifying a process for performing mitigation of the unauthorized attempt to access the protected loader block.