IP Library › Granted Patent US 10,809,924

Granted Patent B2

US 10,809,924 · App. 15/951,861 · Granted Oct 20, 2020

Executable memory protection

Inventor: Andrew L. Sandoval (San Antonio, TX)

Assignee: Webroot Inc.

G06F3/0622 G06F3/0653 G06F3/0673

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 10,809,924
App. No.: 15/951,861
Granted: Oct 20, 2020
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Examples of the present disclosure describe systems and methods for executable memory protection. In an example, calls to a memory API may be monitored to identify protection attributes of the associated memory. If software requests access to memory that is both executable and writeable, different protection attributes may be used to limit the availability of memory that is both executable and writeable. Subsequently, if software attempts to access the memory in a way not permitted by the different protection attributes, a resulting memory exception may be evaluated to determine whether to modify the memory protection attributes. In examples, the memory protection attributes may be updated accordingly (e.g., to be made executable but not writeable, writeable but not executable, etc.) and execution of the set of software instructions may resume. Thus, memory that is both executable and writeable may be reduced or eliminated; decreasing the likelihood of exploitation by malicious software.

Claims (97)

1. A system comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operations, the set of operations comprising:

generating a hook on a memory application programming interface (API), wherein the hook is associated with a threat processor;

registering an exception handler;

receiving, by the threat processor, an indication from the generated hook, wherein the indication is received in response to a set of software instructions generating a call to the memory API;

based on the received indication, generating stored memory information comprising one or more protection attributes associated with the call to the memory API;

determining whether the one or more protection attributes indicate memory that is executable and writeable;

based on determining the one or more protection attributes indicate memory that is executable and writeable, modifying the one or more protection attributes to generate modified protection attributes;

continuing execution of the set of software instructions based on the modified protection attributes;

receiving, by the threat processor, an indication of a memory exception from the exception handler, wherein the memory exception is associated with accessing memory having the modified protection attributes by the set of software instructions;

determining one or more requested protection attributes associated with the memory exception;

determining, based on the stored memory information, whether the set of software instructions is permitted access to memory having at least one of the one or more requested protection attributes;

upon determining that the set of software instructions is permitted access to memory having at least one of the one or more requested protection attributes:

modifying the memory having the modified protection attributes based on the one or more requested protection attributes;

upon determining that the set of software instructions is not permitted access to memory having at least one of the one or more requested protection attributes:

based on determining that the set of software instructions satisfies one or more security criteria, modifying the memory having the modified protection attributes based on the one or more requested protection attributes;

based on determining that the set of software instructions does not satisfy one or more security criteria:

generating a prompt for display to a user requesting input regarding whether the set of software instructions should be permitted access to memory having at least one of the one or more requested protection attributes,

receiving a user indication in response to the generated prompt,

based on determining that the user indication permits the set of software instructions to access to memory having at least one of the one or more requested protection attributes, modifying the memory having the modified protection attributes based on the one or more requested protection attributes; and

resuming software execution.

2. The system of claim 1 , wherein modifying the one or more protection attributes to generate modified protection attributes comprises generating modified protection attributes that indicate memory that is one of executable or writeable.

3. The system of claim 1 , wherein modifying the one or more protection attributes to generate modified protection attributes comprises:

determining whether the set of software instructions needs access to memory that is both executable and writeable;

based on determining that the set of software instructions needs access to memory that is both executable and writeable, determining whether the set of software instructions is permitted access to memory that is both executable and writeable; and

when it is determined that the set of software instructions is not permitted access to memory that is both executable and writeable, modifying the one or more protection attributes to generate the modified protection attributes.

4. The system of claim 1 , wherein the set of operations further comprises:

based on determining that the set of software is not permitted access to memory having the at least one of the one or more requested protection attributes, retaining the modified protection attributes; and

continuing execution of the set of software instructions using the memory having the modified protection attributes.

5. The system of claim 1 , wherein modifying the memory having the modified protection attributes based on the one or more requested protection attributes comprises:

when the modified protection attributes indicate writeable memory, modifying protection attributes associated with the memory to be executable and not writeable; and

when the modified protection attributes indicate executable memory, modifying protection attributes associated with the memory to be writeable and not executable.

6. The system of claim 1 , wherein determining whether the set of software instructions is permitted access to memory having at least one of the one or more requested protection attributes comprises:

determining whether the set of software instructions needs access to memory that is both executable and writeable;

7. A method for protecting executable memory, comprising:

registering an exception handler;

receiving, by a threat processor, an indication of a memory exception from the exception handler, wherein the memory exception is associated with a set of software instructions accessing memory associated with one or more current protection attributes;

determining one or more requested protection attributes associated with the memory exception;

determining whether the set of software instructions is permitted access to memory having at least one of the one or more requested protection attributes;

upon determining that the set of software is permitted access to memory having the at least one of the one or more requested protection attributes:

modifying the memory associated with the current protection attributes based on the one or more requested protection attributes;

upon determining that the set of software instructions is not permitted access to memory having at least one of the one or more requested protection attributes:

based on determining that the set of software instructions does not satisfy one or more security criteria:

receiving a user indication in response to the generated prompt,

continuing execution of the set of software instructions using the memory.

8. The method of claim 7 , further comprising:

based on determining that the set of software is not permitted access to memory having the at least one of the one or more requested protection attributes, retaining the current protection attributes; and

continuing execution of the set of software instructions using the memory having the current protection attributes.

9. The method of claim 7 , wherein determining whether the set of software instructions is permitted access to memory having at least one of the one or more requested protection attributes comprises evaluating stored memory information.

10. The method of claim 7 , wherein determining whether the set of software instructions is permitted access to memory having at least one of the one or more requested protection attributes comprises:

determining whether the set of software instructions needs access to memory that is both executable and writeable;

11. The method of claim 7 , wherein modifying the memory associated with the current protection attributes based on the one or more requested protection attributes comprises:

when the current protection attributes indicate writeable memory, modifying protection attributes associated with the memory to be executable and not writeable; and

when the current protection attributes indicate executable memory, modifying protection attributes associated with the memory to be writeable and not executable.

12. The method of claim 9 , wherein the stored memory information is generated by the threat processor based on a call by the set of software instructions to a memory application programming interface (API), and wherein the memory information comprises one or more protection attributes associated with the call to the memory API.

13. A method for protecting executable memory, comprising: