Detection of shellcode
View Patent ↗Particular embodiments described herein provide for an electronic device that can be configured to monitor code as it executes. The code can include self-modifying code. The system can log an event if the self-modifying code occurred in a GetPC address region.
1. At least one non-transitory machine readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:
detect execution of a GetPC instruction sequence;
in response to detecting the execution of the GetPC instruction sequence, return to the GetPC instruction sequence a poison GetPC address in a GetPC address region instead of a current PC address, wherein the poison GetPC address is an identifiable invalid address;
determine whether self-modifying code is detected;
monitor, based on a determination that self-modifying code is detected, code as it executes to detect whether execution of the self-modifying code occurred at the poison GetPC address in the GetPC address region; and
based on a determination that the execution of the self-modifying code occurred at the poison GetPC address in the GetPC address region:
log an event; and
analyze the code for malware.
2. The at least one machine readable medium of claim 1 , wherein the poison GetPC address causes a memory fault.
3. The at least one machine readable medium of claim 1 , further comprising one or more instructions that when executed by at least one processor, further cause the at least one processor to:
log the event based on a determination that a memory fault exception occurred during translation and the memory fault translation matches with the identifiable invalid address.
4. The at least one machine readable medium of claim 1 , further comprising one or more instructions that when executed by at least one processor, further cause the at least one processor to:
communicate the code to a security module based on a determination that the self-modifying code occurred at the poison GetPC address in the GetPC address region.
5. The at least one machine readable medium of claim 1 , further comprising one or more instructions that when executed by at least one processor, further cause the at least one processor to:
determine whether an exception occurred during a translation of the code; and
log the event based on a determination that the exception occurred at the identifiable invalid address.
6. The at least one machine readable medium of claim 1 , further comprising one or more instructions that when executed by at least one processor, further cause the at least one processor to:
communicate the code to a security module based on a determination that the code is in a writeable memory region.
7. An apparatus comprising:
a processor coupled to a memory; and
the memory storing executable instructions that when executed by the processor cause the processor to:
detect execution of a GetPC instruction sequence;
in response to detecting the execution of the GetPC instruction sequence, return to the Get PC instruction sequence a poison GetPC address in a GetPC address region on the memory instead of a current PC address, wherein the poison GetPC address is an identifiable invalid address;
determine whether self-modifying code is detected;
monitor, based on a determination that self-modifying code is detected, code as it executes to detect whether execution of the self-modifying code occurred at the poison GetPC address in the GetPC address region; and
based on a determination that the execution of the self-modifying code occurred at the poison GetPC address in the GetPC address region of the memory:
log an event; and
analyze the code for malware.
8. The apparatus of claim 7 , wherein the poison GetPC address causes a memory fault.
9. The apparatus of claim 7 , wherein the executable instructions that when executed by the processor further cause the processor to:
log the event based on a determination that a memory fault exception occurred during translation and the memory fault translation matches with the identifiable invalid address.
10. The apparatus of claim 7 , wherein the executable instructions that when executed by the processor further cause the processor to:
communicate the code to a security module based on a determination that the self-modifying code occurred at the poison GetPC address in the GetPC address region.
11. The apparatus of claim 7 , wherein the executable instructions that when executed by the processor further cause the processor to:
determine whether an exception occurred during a translation of the code; and
log an event based on a determination that the exception occurred at the identifiable invalid address.
12. The apparatus of claim 7 , wherein the executable instructions that when executed by the processor further cause the processor to:
communicate the code to a security module based on a determination that the code is in a writeable memory region.
13. A method comprising:
detecting execution of a GetPC instruction sequence;
in response to detecting the execution of the GetPC instruction sequence, returning to the GetPC instruction sequence a poison GetPC address in a GetPC address region instead of a current PC address, wherein the poison GetPC address is an identifiable invalid address;
determining whether self-modifying code is detected;
monitoring, based on a determination that self-modifying code is detected, code as it executes to detect whether execution of the self-modifying code occurred at the poison GetPC address in the GetPC address region; and
based on a determination that the execution of the self-modifying code occurred at the poison GetPC address in the GetPC address region:
logging an event; and
analyzing the code for malware.
14. The method of claim 13 , wherein the poison GetPC address causes a memory fault.
15. The method of claim 13 , further comprising:
logging the event based on a determination that a memory fault exception occurred during translation and the memory fault translation matches with the identifiable invalid address.
16. The method of claim 13 , further comprising:
communicating the code to a security module based on a determination that the self-modifying code occurred at the poison GetPC address in the GetPC address region.
17. The method of claim 13 , further comprising:
determining whether an exception occurred during a translation of the code; and
logging the event based on a determination that the exception occurred at the identifiable invalid address.
18. The at least one machine readable medium of claim 1 , wherein the self-modifying code includes a self-decrypting code sequence.
19. The apparatus of claim 7 , wherein the self-modifying code includes a self-decrypting code sequence.
20. The method of claim 13 , wherein the self-modifying code includes a self-decrypting code sequence.