Detecting and preventing execution of software exploits
In non-limiting examples, anti-exploit systems and methods described herein monitor a memory space of a process for execution of functions. Stack walk processing is executed upon invocation of one of the functions in the monitored memory space. During execution of the stack walk processing, at least one memory check is performed to detect suspicious behavior. An alert of suspicious behavior is triggered when the performing of the memory check detects at least one of: code execution attempted from non-executable memory, identification of an invalid base pointer, identification of an invalid stack return address, attempted execution of a return-oriented programming technique, the base pointer is outside a current thread stack, and a return address is detected as being inside a virtual memory area. If an alert of suspicious behavior is triggered, execution of a payload is prevented for the invoked function.
1. A computer-implemented method comprising:
monitoring a memory space of a process for execution of at least one monitored function of a plurality of functions, wherein monitoring the memory space comprises loading a component for evaluating the at least one monitored function in the memory space;
invoking one of the plurality of functions as a result of receiving a call from an application programming instance;
executing stack walk processing upon the invocation of one of the plurality of functions in the monitored memory space; and
performing, during the executing of the stack walk processing before an address of an originating caller function is reached, a memory check for a plurality of stack entries identified during the stack walk processing to detect suspicious behavior, wherein an alert of suspicious behavior is triggered when the performing of the memory check detects at least one of the following:
code execution is attempted from non-executable memory,
a base pointer is identified as being invalid,
an invalid stack return address is identified,
attempted execution of a return-oriented programming technique is detected,
the base pointer is detected as being outside a current thread stack, and
a return address is detected as being inside a virtual memory area,
wherein when an alert of suspicious behavior is triggered, preventing execution of a payload for the invoked function from operating.
2. The method according to claim 1 , further comprising:
identifying an address associated with the invoked function; and
when the address of the invoked function address is found in a cache, preventing execution of a payload for the invoked function.
3. The method according to claim 1 , wherein executing of the stack walk processing further comprises walking a stack frame associated with the invoked function from a low level user mode function to the originating address of the invoked function.
4. The method according to claim 1 , wherein the monitoring further comprises monitoring functions associated with memory management in the memory space by a user mode function.
5. The method according to claim 1 , wherein the monitoring further comprises applying, upon detecting a function call of one of the plurality of functions in the monitored memory space, a hooking technique to hook a lowest level user mode function of the invoked function, wherein the executing of the stack walk processing executes a reverse stack walk from the lowest level user mode function of the invoked function.
6. The method according to claim 1 , wherein the plurality of functions comprises an NtAllocateVirtualMemory function, an NtProtectVirtualMemory function, an NtCreateProcess function, an NtCreateProcessEX function, an NtCreateUserIProcess function, and an LdrLoadDll function.
7. The method according to claim 5 , wherein performing the memory check comprises evaluating state information associated with a cache entry for the hooked function.
8. The method according to claim 7 , wherein when an address of the invoked function is found in a cache, preventing execution of a payload for the invoked function.
9. A system comprising:
at least one memory; and
at least one processor connected with the memory configured to perform operation of:
monitoring a memory space of a process for execution of at least one monitored function of a plurality of functions, wherein monitoring the memory space comprises loading a component for evaluating the at least one monitored function in the memory space;
invoking one of the plurality of functions as a result of receiving a call from an application programming instance;
executing stack walk processing upon the invocation of one of the plurality of functions in the monitored memory space; and
performing, during the executing of the stack walk processing before an address of an originating caller function is reached, a memory check for a plurality of stack entries identified during the stack walk processing to detect suspicious behavior, wherein an alert of suspicious behavior is triggered when the performing of the memory check detects at least one of the following:
code execution is attempted from non-executable memory,
a base pointer is identified as being invalid,
an invalid stack return address is identified,
attempted execution of a return-oriented programming technique is detected,
the base pointer is detected as being outside a current thread stack, and
a return address is detected as being inside a virtual memory area,
wherein when an alert of suspicious behavior is triggered, the method further comprising preventing execution of a payload for the invoked function.
10. The system according to claim 9 , further comprising identifying an address associated with the invoked function; and when the address of the invoked function is found in a cache, and wherein the processor further executing an operation of preventing execution of a payload for the invoked function.
11. The system according to claim 9 , wherein the executing of the stack walk processing further comprises walking a stack frame associated with the invoked function from a low level user mode function to the originating address of the invoked function.
12. The system according to claim 9 , wherein the monitoring further comprises monitoring functions associated with memory management in the memory space by a user mode function.
13. The system according to claim 9 , wherein the monitoring further comprises applying, upon detecting a function call of one of the plurality of functions in the monitored memory space, a hooking technique to hook a lowest level user mode function of the invoked function, and wherein the executing of the stack walk processing executes a reverse stack walk from the lowest level user mode function of the invoked function.
14. The system according to claim 9 , wherein the plurality of functions comprises an NtAllocateVirtualMemory function, an NtProtectVirtualMemory function, an NtCreateProcess function, an NtCreateProcessEX function, an NtCreateUserIProcess function, and an LdrLoadDll function.
15. The system according to claim 13 , wherein performing of the memory check comprises evaluating state information associated with a cache entry for the hooked function.
16. The system according to claim 15 , wherein when an address of the invoked function is found in a cache, and wherein the processor further executing an operation of preventing execution of a payload for the invoked function.
17. A computer-readable storage device containing instructions, that when executed on at least one processor, causing the processor to execute a process comprising:
monitoring a memory space of a process for execution of at least one monitored function of a plurality of functions, wherein monitoring the memory space comprises loading a component for evaluating the at least one monitored function in the memory space;
invoking one of the plurality of functions as a result of receiving a call from an application programming instance;
executing stack walk processing upon the invocation of one of the plurality of functions in the monitored memory space; and
performing, during the executing of the stack walk processing before an address of an originating caller function is reached, a memory check for a plurality of stack entries identified during the stack walk processing to detect suspicious behavior, wherein an alert of suspicious behavior is triggered when the performing of the memory check detects at least one of the following:
code execution is attempted from non-executable memory,
a base pointer is identified as being invalid,
an invalid stack return address is identified,
attempted execution of a return-oriented programming technique is detected,
the base pointer is detected as being outside a current thread stack,
a return address is detected as being inside a virtual memory area, and
a low level user mode function is attempted to be executed in a cache, wherein the cache is evaluated for an address of the invoked function, and
wherein when an alert of suspicious behavior is triggered, preventing execution of a payload for the invoked function.
18. The computer-readable storage device according to claim 17 , wherein performing of the memory check to determine if code execution is attempted from non-executable memory, the base pointer is identified as being invalid, an invalid stack return address is identified, execution of a return-oriented programming technique is attempted, the base pointer is detected as being outside a current thread stack, and the return address is detected as being inside a virtual memory area, occurs before an address of the invoked function is reached, and
wherein the performing of the memory check to determine whether the low level user mode function is attempted to be executed in the cache occurs upon reaching the address of the invoked function in the execution of the stack walk processing.