Systems and methods for detecting malformed arguments in a function by hooking a generic object
AssigneeSymantec Corporation
InventorsIan Oliver, Subhash Gaonkar
Life of this patent
Estimating the term…
Abstract
A computer-implemented method to detect malformed arguments in a function by hooking a generic object, is described. A predetermined argument to monitor is identified. An activity associated with a calling of a function to produce a called out function is detected. The called out function is mapped to a class identification of an object. An argument in the called out function is compared with the predetermined argument. When a match exists, a virtual method table identification is recorded for the called out function. The match between the argument in the called out function and the predetermined argument is reported.
Claims14
A computer-implemented method to detect malformed arguments in a function by hooking a generic object, comprising:
- identifying, by a processor, a predetermined argument to monitor;
- detecting, by the processor, an activity associated with a calling of a function to produce a called out function, the called out function comprising an invoke function;
- mapping, by the processor, the called out function to a class identification of an object that called the function;
- determining, by the processor, that the class identification of the object corresponds to an interface that created the object;
- upon determining that the class identification of the object corresponds to the interface that created the object, comparing, by the processor, an argument in the called out function with the predetermined argument;
- when a match exists, recording, by the processor, a virtual method table identification for the called out function;
- reporting, by the processor, the match between the argument in the called out function and the predetermined argument;
- and
- reporting an identity of the object and the called out function.
A computing device configured to detect malformed arguments in a function by hooking a generic object, comprising:
- a processor;
- memory in electronic communication with the processor;
- and
- instructions stored in the memory, the instructions being executable by the processor to:
- identify a predetermined argument to monitor;
- detect an activity associated with a calling of a function to produce a called out function, the called out function comprising an invoke function;
- map the called out function to a class identification of an object that called the function;
- determine that the class identification of the object corresponds to an interface that created the object;
- upon determining that the class identification of the object corresponds to the interface that created the object, compare an argument in the called out function with the predetermined argument;
- when a match exists, record a virtual method table identification for the called out function;
- report the match between the argument in the called out function and the predetermined argument;
- and
- report an identity of the object and the called out function.
A computer-program product for detecting malformed arguments in a function by hooking a generic object, the computer-program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions being executable by a processor to:
- identify a predetermined argument to monitor;
- detect an activity associated with a calling of a function to produce a called out function, the called out function comprising an invoke function;
- map the called out function to a class identification of an object that called the function;
- determine that the class identification of the object corresponds to an interface that created the object;
- upon determining that the class identification of the object corresponds to the interface that created the object, compare an argument in the called out function with the predetermined argument;
- when a match exists, record a virtual method table identification for the called out function;
- report the match between the argument in the called out function and the predetermined argument;
- and
- report an identity of the object and the called out function.
Dependencies are inferred from the claim text.