Detection and mitigation of malicious invocation of sensitive code
View Patent ↗Particular embodiments described herein provide for an electronic device that can be configured to identify regions of code to be monitored, probe and lock code pages that include the identified regions of code, and remap the code pages as execute only to assist with the mitigation of malicious invocation of sensitive code. The code pages can be remapped as execute only in an alternate extended page table view to allow for the detection and mitigation of malicious invocation of sensitive code.
1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor:
identify regions of code in an extended page table that includes API code pages to be monitored;
probe and lock code pages that include the identified regions of code;
remap the code pages as executable in an alternate extended page table view only;
detect a page load, wherein the page load is for a page that does not include the proper entry point of an API;
determine, based on detecting the page load of the page that does not include the proper entry point of the API, from the extended page table whether the page is to be monitored; and
generate, based on the determination that the page is to be monitored, an execution fault.
2. The at least one computer-readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor:
capture indirect virtual addressing branches and returns for the code pages.
3. The at least one computer-readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor:
handle execution faults on the code pages with a virtualized exception handler.
4. The at least one computer-readable medium of claim 1 , wherein the execution fault is an extended page table fault.
5. The at least one computer-readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor:
inspect context information related to the execution fault to determine if an entry point for the application program interface execution request is valid.
6. The at least one computer-readable medium of claim 5 , further comprising one or more instructions that when executed by the at least one processor:
map the entry offset to the stack offset if the entry point is not valid.
7. The at least one computer-readable medium of claim 1 , further comprising one or more instructions that when executed by the at least one processor:
de-privilege the identified regions of code from being executed in a default extended page table view.
8. An apparatus comprising:
memory; and
a monitoring module in the memory configured to:
identify regions of code in an extended page table that includes sensitive API code pages to be monitored;
probe and lock code pages that include the identified regions of code;
remap the code pages as executable in an alternate extended page table view only;
detect a page load, wherein the page load is for loading a page that does not include the proper entry point of an API;
determine, based on detecting the page load of the page that does not include the proper entry point of the API, from the extended page table whether the page is to be monitored; and
generate, based on the determination that the page is to be monitored, an execution fault.
9. The apparatus of claim 8 , wherein the monitoring module is further configured to:
capture indirect virtual addressing branches and returns for the code pages.
10. The apparatus of claim 8 , wherein the monitoring module is further configured to:
handle execution faults on the code pages with a virtualized exception handler.
11. The apparatus of claim 8 , wherein the monitoring module fault is an extended page table fault.
12. The apparatus of claim 8 , wherein the monitoring module is further configured to:
inspect context information related to the execution fault to determine if an entry point for the application program interface execution request is valid.
13. The apparatus of claim 12 , wherein the monitoring module is further configured to:
map the entry offset to the stack offset if the entry point is not valid.
14. A method comprising:
identifying regions of code in an extended page table that includes API code pages to be monitored;
probing and locking code pages that include the identified regions of code;
remapping the code pages as executable in an alternate extended page table view only;
detecting a page load, wherein the page load is for loading a page that does not include the proper entry point of an API;
determining, based on detecting the page load of the page that does not include the proper entry point of the API, from the extended page table whether the page is to be monitored; and
generating, based on the determination that the page is to be monitored, an execution fault.
15. The method of claim 14 , further comprising:
capturing indirect virtual addressing branches and returns for the code pages.
16. The method of claim 14 , further comprising:
handling execution faults on the code pages with a virtualized exception handler.
17. The method of claim 14 , wherein the execution fault is an extended page table fault.
18. The method of claim 14 , further comprising:
inspecting context information related to the execution fault to determine if an entry point for the application program interface execution request is valid; and
mapping the entry offset to the stack offset if the entry point is not valid.
19. A system for detecting and mitigating malicious invocation of sensitive code, the system comprising:
memory; and
a monitoring module in the memory configured for:
identifying regions of code in an extended page table that includes API code pages to be monitored;
probing and locking code pages that include the identified regions of code;
remapping the code pages as executable in an alternate extended page table view only;
detecting a page load, wherein the page load is for a page that does not include the proper entry point of an API;
determining, based on detecting the page load of the page that does not include the proper entry point of the API, from the extended page table whether the page is to be monitored; and
generating, based on the determination that the page is to be monitored, an execution fault.
20. The system of claim 19 , wherein the system is configured to:
inspect context information related to the execution fault to determine if an entry point for the application program interface execution request is valid.