Tracking memory mapping to prevent packers from evading the scanning of dynamically created code
View Patent ↗To detect possible malicious code that is unpacked at runtime before it is executed, antivirus software requires that any dynamically created code be scanned before it can be executed by a host computer system. This requirement may be enforced by requiring memory pages to be either executable or writable, but not both. Before changing from writable but not executable to executable but not writable, the page is scanned for malicious code. To prevent packers from evading this scanning, a countermeasure tracks the memory mapping in the host system to enforce consistency in the protection settings for all memory spaces that are mapped to the same physical memory page.
1. A computer program product for protecting a host computer system against dynamically unpacked malicious code, the computer program product comprising a non-transitory computer-readable storage medium containing executable computer program code for:
detecting an attempt by a program to unpack code by writing to a memory page on the host computer system that is set to be executable but not writable, wherein the attempt by the program to unpack the code is made by addressing the memory page using a first address;
intercepting an exception to allow the program to unpack the code by writing to the memory page;
tracking a shared memory region in the host computer system to determine a plurality of addresses mapped to the memory page responsive to the exception, the plurality of addresses including the first address and a second address distinct from the first address that both map to the memory page;
marking each of the plurality of addresses that maps to the memory page to be writable but non-executable thereby allowing the program to unpack the code to the memory page;
detecting an attempt by the program to execute the unpacked code on the memory page by addressing the memory page using the second address;
before executing the unpacked code on the memory page, scanning the memory page for malicious code; and
executing the unpacked code on the memory page if the scanning does not identify malicious code.
2. The computer program product of claim 1 , wherein detecting the attempt to execute the unpacked code on the memory page comprises intercepting a second exception generated by a memory manager when the program attempts to execute the unpacked code on the memory page, the memory page set to be writable but not executable.
3. The computer program product of claim 1 , the computer-readable medium further containing computer program code for:
keeping the memory page as being non-executable if the scanning identifies malicious code on the memory page.
4. The computer program product of claim 1 , the computer-readable medium further containing computer program code for:
declaring an existence of malicious code if the scanning identifies malicious code on the memory page.
5. The computer program product of claim 1 , wherein scanning the memory page for malicious code comprises analyzing the memory page using a set of known signatures for malicious code.
6. A computer-implemented method for protecting a host computer system against dynamically unpacked malicious code, the method comprising:
detecting an attempt by a program to unpack code by writing to a memory page on the host computer system that is set to be executable but not writable, wherein the attempt by the program to unpack the code is made by addressing the memory page using a first address;
intercepting an exception to allow the program to unpack the code by writing to the memory page;
tracking a shared memory region in the host computer system to determine a plurality of addresses mapped to the memory page responsive to the exception, the plurality of addresses including the first address and a second address distinct from the first address that both map to the memory page;
marking each of the plurality of addresses that maps to the memory page to be writable but non-executable thereby allowing the program unpack the code to the memory page;
detecting an attempt by the program to execute the unpacked code on the memory page, wherein the attempt by the program to execute the unpacked code is made by addressing the memory page using the second address;
before executing the unpacked code on the memory page, scanning the memory page for malicious code; and
executing the unpacked code on the memory page if the scanning does not identify malicious code.
7. The method of claim 6 , wherein detecting the attempt to execute the unpacked code on the memory page comprises intercepting a second exception generated by a memory manager when the program attempts to execute the unpacked code on the memory page, the memory page set to be writable but not executable.
8. The method of claim 6 , further comprising:
keeping the memory page as being non-executable if the scanning does identify malicious code on the memory page.
9. The method of claim 6 , further comprising:
declaring an existence of malicious code if the scanning does identify malicious code on the memory page.
10. The method of claim 6 , wherein scanning the memory page for malicious code comprises analyzing the memory page using a set of known signatures for malicious code.
11. A computer system for protecting against dynamically unpacked malicious code, the computer system comprising:
a computer processor; and
a non-transitory computer-readable storage medium storing executable instructions configured to execute on the computer processor, the instructions when executed by the computer processor configured to perform steps comprising:
detecting an attempt by a program to unpack code by writing to a memory page on the host computer system that is set to be executable but not writable, wherein the attempt by the program to unpack the code is made by addressing the memory page using a first address;
intercepting an exception to allow the program to unpack the code by writing to the memory page;
tracking a shared memory region in the host computer system to determine a plurality of addresses mapped to the memory page responsive to the exception, the plurality of addresses including the first address and a second address distinct from the first address that both map to the memory page;
marking each of the plurality of addresses that maps to the memory page to be writable but non-executable thereby allowing the program to unpack the code to the memory page;
detecting an attempt by the program to execute the unpacked code on the memory page, wherein the attempt by the program to execute the unpacked code is made by addressing the memory page using the second address;
before executing the unpacked code on the memory page, scanning the memory page for malicious code; and
executing the unpacked code on the memory page if the scanning does not identify malicious code.
12. The computer system of claim 11 , wherein detecting the attempt to execute the unpacked code on the memory page comprises intercepting a second exception generated by a memory manager when the program attempts to execute the unpacked code on the memory page, the memory page set to be writable but not executable.
13. The computer system of claim 11 , the instructions when executed by the computer processor configured to further perform steps comprising:
keeping the memory page as being non-executable if the scanning identifies malicious code on the memory page.
14. The computer system of claim 11 , the instructions when executed by the computer processor configured to further perform steps comprising:
declaring an existence of malicious code if the scanning identifies malicious code on the memory page.
15. The computer system of claim 11 , wherein scanning the memory page for malicious code comprises analyzing the memory page using a set of known signatures for malicious code.
16. The computer system of claim 11 , wherein the memory page comprises physical memory and the shared memory region comprises virtual memory.
17. The computer program product of claim 1 , wherein the memory page comprises physical memory and the shared memory region comprises virtual memory.
18. The method of 6 , wherein the memory page comprises physical memory and the shared memory region comprises virtual memory.