Systems and methods of protecting data from injected malware
Provided herein are systems and methods for protecting data from injected malware. In some embodiments, a virtual memory validator may execute in user mode memory space on a computing device. The virtual memory validator may monitor an execution stack of an executing thread of a process. The virtual memory validator may identify a memory address referenced in the execution stack, responsive to the process attempting to access a protected resource. The virtual memory validator may determine that the memory address refers to a memory region that is designated as executable. The virtual memory validator may determine that the memory address is outside memory regions identified in a memory range map. The virtual memory validator may, responsive to the determination, identify the process as a potential malware process.
1. A method of validating processes, the method comprising:
monitoring, by a virtual memory validator injected into a process executing in a user mode memory space on a computing device, an execution stack of an executing thread of the process;
identifying, by the virtual memory validator in the user mode memory space, a memory address referenced in the execution stack, responsive to the process in the user mode memory space attempting to access a protected resource in a kernel mode memory space;
determining, by the virtual memory validator, that the memory address attempted to be accessed from the user mode memory space refers to a memory region that is yet to be designated as executable in the kernel mode memory space;
determining, by the virtual memory validator, that the memory address is within memory regions identified in a memory range map that specifies memory addresses for a plurality of validated processes including the process; and
identifying, by the virtual memory validator responsive to the determination that the memory address refers to the memory region that is yet to be designated as executable in the kernel mode memory space and to the determination that the memory address is within the memory regions identified in the memory range map, the process as a validated process.
2. The method of claim 1 , further comprising determining, by the virtual memory validator, that another memory address is not associated with the execution stack of the executing thread of the process besides the memory address; and
wherein identifying the process as the validated process further comprises identifying the process as the validated process responsive to the determination that the another memory address is not associated with the execution stack besides the memory address.
3. The method of claim 1 , wherein determining that the memory address refers to the memory region yet to be designated as executable further comprises determining that the memory address attempted to be accessed from the user mode memory space refers to a memory region allocated to data.
4. The method of claim 1 , wherein determining that the memory address refers to the memory region yet to be designated as executable further comprises using a virtual protect function to identify the memory region as yet to be designated as executable.
5. The method of claim 1 , wherein determining that the memory address is within the memory regions identified in the memory range map further comprises determining that the memory address corresponds to at least one entry of a plurality of entries in the memory range map, each of the plurality of entries identifying a memory address allocated to at least one of the plurality of validated processes.
6. The method of claim 1 , wherein identifying the memory address further comprises traversing a plurality of memory addresses of the execution stack of the executing thread to identify the memory address referenced in the execution stack.
7. The method of claim 1 , further comprising interfacing, by the virtual memory validator, with a virtual memory validator proxy executing in the user mode memory space on the computing device to invoke the virtual memory validator proxy to present information via the computing device.
8. The method of claim 1 , further comprising establishing, by the virtual memory validator, an executable load indicator to monitor one or more function calls of the executing thread of the process, responsive to injection of the virtual memory validator into the process, and to identify the memory address attempted to be accessed by the process.
9. The method of claim 1 , further comprising providing, by a driver executing in the kernel mode memory space, an indication that the process from the user mode memory space is attempting to access the protected resource in the kernel mode memory space.
10. The method of claim 1 , further comprising permitting, by an action examiner executing in the kernel mode memory space, at least the executing thread of the process to access to the protected resource responsive to identifying the process as the validated process.
11. A system for validating processes, the system comprising:
memory space on a computing device, comprising a user mode memory space and a kernel mode memory space; and
a virtual memory validator injected into a process executable in the user mode memory space, the virtual memory validator configured to:
monitor an execution stack of an executing thread of the process executing in the user mode memory space;
identify a memory address referenced in the execution stack, responsive to the process from the user mode memory space attempting to access a protected resource of the kernel mode memory space;
determine that the memory address refers to a memory region attempted to be accessed from the user mode memory space that is yet to be designated as executable in the kernel mode memory space;
determine that the memory address is within memory regions identified in a memory range map that specifies memory addresses for a plurality of validated processes including the process; and
identify, responsive to the determination that the memory address refers to the memory region that is yet to be designated as executable in the kernel mode memory space or to the determination that the memory address is within the memory regions identified in the memory range map, the process as a validated process.
12. The system of claim 11 , wherein the virtual memory validator is further configured to:
determine that another memory address is not associated with the execution stack of the executing thread of the process besides the memory address; and
identify the process as the validated process responsive to the determination that the another memory address is not associated with the execution stack besides the memory address.
13. The system of claim 11 , wherein the virtual memory validator is further configured to determine that the memory address attempted to be accessed from the user mode memory space, refers to a memory region allocated to data.
14. The system of claim 11 , wherein the virtual memory validator is further configured to use a virtual protect function to identify the memory region as yet to be designated as executable.
15. The system of claim 11 , wherein the virtual memory validator is further configured to determine that the memory address corresponds to at least one entry of a plurality of entries in the memory range map, each of the plurality of entries identifying a memory address allocated to at least one of the plurality of validated processes.
16. The system of claim 11 , wherein the virtual memory validator is further configured to traverse a plurality of memory addresses of the execution stack of the executing thread to identify the memory address referenced in the execution stack.
17. The system of claim 11 , wherein the virtual memory validator is further configured to interface, with a virtual memory validator proxy executing in the user mode memory space on the computing device to invoke the virtual memory validator proxy to present information via the computing device.
18. The system of claim 11 , wherein the virtual memory validator is further configured to establish an executable load indicator to monitor one or more function calls of the executing thread of the process, responsive to injection of the virtual memory validator into the process, and to identify the memory address attempted to be accessed by the process.
19. The system of claim 11 , further comprising a driver executable in the kernel mode memory space configured to provide an indication that the process from the user mode memory space is attempting to access the protected resource in the kernel mode memory space.
20. The system of claim 11 , further comprising an action examiner executable in the kernel mode memory space, configured to permit at least the executing thread of the process to access to the protected resource responsive to identifying the process as the validated process.