Information device, program, method, and computer readable recording medium for preventing execution of malicious program code

1. An information device which performs data processing by executing program codes loaded in a memory of the information device, the information device comprising:

a display; and

a controller comprising a CPU which executes a program stored in the memory of the information device so as to operate as:

a detection unit which detects a timing when any one of the program codes is called;

a return address acquisition unit which sequentially acquires return addresses of the program codes loaded in the memory at the timing detected by the detection unit, wherein the return addresses respectively point to destination addresses to which the respective program codes return to upon completion of the respective program codes; and

a termination unit which searches for an illegal access based on the destination addresses that are sequentially acquired by the return address acquisition unit at the timing detected by the detection unit, and which terminates the data processing when the illegal access is detected;

wherein the termination unit determines whether or not any of the destination addresses acquired by the return address acquisition unit is a starting address of a function, and when the termination unit determines that any of the destination addresses acquired by the return address acquisition unit is the starting address of the function, the termination unit detects the illegal access and terminates the data processing;

wherein when the termination unit determines that any of the destination addresses acquired by the return address acquisition unit is not the starting address of the function, the termination unit determines whether or not an address located just before any of the destination addresses acquired by the return address acquisition unit stores a call instruction, and when the termination unit determines that the address located just before any of the destination addresses acquired by the return address acquisition unit does not store the call instruction, the termination unit detects the illegal access and terminates the data processing; and

wherein when the termination unit detects the illegal access, the controller displays on the display a dialog stating that the data processing is temporarily terminated.

2. The information device as claimed in claim 1 , wherein

the memory has a stack area used for storing the destination addresses of the program codes, and

the return address acquisition unit traces and acquires the destination addresses stored in the stack area.

3. A method for preventing execution of a malicious program code in a computer which executes program codes loaded in a memory of the computer, the method comprising:

detecting a timing when any one of the program codes is called;

sequentially acquiring return addresses of the program codes loaded in the memory at the detected timing, wherein the return addresses respectively point to destination addresses to which the respective program codes return to upon completion of the respective program codes;

detecting an illegal access based on the acquired destination addresses; and

when the illegal access is detected, terminating data processing and displaying on a display a dialog stating that the data processing is temporarily terminated;

wherein the illegal access is detected by determining whether or not any of the acquired destination addresses is a starting address of a function, and wherein when it is determined that any of the acquired destination addresses is the starting address of the function, the illegal access is detected and the data processing is terminated;

wherein when it is determined that any of the acquired destination addresses is not the starting address of the function, the illegal access is detected by determining whether or not an address located just before any of the acquired destination addresses stores a call instruction, and wherein when it is determined that the address located just before any of the acquired destination addresses does not store the call instruction, the illegal access is detected and the data processing is terminated; and

wherein the detecting of the timing, the sequentially acquiring, the detecting of the illegal access, and the terminating are performed by executing a program stored in the memory of the computer.

4. A non-transitory computer-readable recording medium which stores a program configured to make a computer, which executes program codes loaded in a memory, function as:

a detection unit which detects a timing when any one of the program codes is called;

a return address acquisition unit which sequentially acquires return addresses of the program codes loaded in the memory at the timing detected by the detection unit, wherein the return addresses respectively point to destination addresses to which the respective program codes return to upon completion of the respective program codes; and

a termination unit which searches for an illegal access based on the destination addresses that are sequentially acquired by the return address acquisition unit at the timing detected by the detection unit, and which terminates the data processing when the illegal access is detected;

wherein the termination unit determines whether or not any of the destination addresses acquired by the return address acquisition unit is a starting address of a function, and when the termination unit determines that any of the destination addresses acquired by the return address acquisition unit is the starting address of the function, the termination unit detects the illegal access and terminates the data processing;

wherein when the termination unit determines that any of the destination addresses acquired by the return address acquisition unit is not the starting address of the function, the termination unit determines whether or not an address located just before any of the destination addresses acquired by the return address acquisition unit stores a call instruction, and when the termination unit determines that the address located just before any of the destination addresses acquired by the return address acquisition unit does not store the call instruction, the termination unit detects the illegal access and terminates the data processing; and

wherein when the illegal access is detected, a dialog stating that the data processing is temporarily terminated is displayed on a display.