Post build process to record stack and call tree information

A computer readable storage medium bearing computer executable instructions for detecting whether an application has been hacked, comprising:

• collecting call tree information that is descriptive of a call tree associated with the application after a build of the application is completed and prior to execution of the application, wherein the call tree defines legitimate sequences of intended function calls within the application;
• collecting stack information during execution of the application that is descriptive of actual function calls saved on a stack used by the application;
• comparing the call tree information to the stack information, by comparing a sequence of return addresses to the sequence of function calls of the call tree, during execution of the application to determine whether a return address on the stack is consistent with the call tree, wherein one of the call tree information and the stack information is stored in one of a special section of the application and outside the application, after the call tree information and the stack information has been collected;
• if said return address is consistent with said call tree, then allowing the application to proceed with execution at said return address;
• and
• if said return address is not consistent with said call tree, then taking at least one action comprising at least one of a process termination, altering a monitor process, or triggering an exception, to prevent or deter execution of a code referenced by the return address.

A system comprising a processor for detecting whether a computer program has been subject to modification comprising:

• a first data generated after the computer program build is completed and prior to execution of said program that is descriptive of a call tree associated with the program, the first data stored in a storage readable by the processor, wherein the call tree defines legitimate sequences of intended function calls within the program;
• a second data generated during execution of the program that is descriptive of actual function calls saved on a stack used by the program,
• an authentication module operative during execution of the program, wherein the first data and the second data is used during execution to determine whether a return address on the stack is consistent with the call tree, wherein the determining compares the intended first data function call against the second data function call as saved on the stack by comparing a sequence of return addresses to the sequence of function calls of the call tree;
• if the return address on the stack is consistent with the call tree, then allowing the program to proceed with execution at the return address, if the return address is not consistent with the call tree, then taking at least one action comprising at least one of a process termination, altering a monitor process, or triggering an exception, to prevent or deter execution of a code referenced by the return address.