Patent ID: 8707433
Filing Date: 2014-04-22
Classification: G06F

Abstract:
1. A computer implemented method for detecting a fake exception handler resulting from a malicious stack buffer overflow that overwrote an exception handling record on the stack, the method comprising the steps of: monitoring operating system exception processing logic on a computer; responsive to an exception occurring, identifying an exception handler to be called by the monitored operating system exception processing logic; scanning a specific number of first bytes of the identified exception handler, thereby determining whether a return instruction is present in the first specific number of bytes of the identified exception handler, and responsive to determining whether a return instruction is present in the first specific number of bytes of the identified exception handler performing one from a group of further actions consisting of: 1) responsive to determining that a return instruction is not present in the first specific number of bytes of the identified exception handler, adjudicating the identified exception handler to be legitimate without further testing; and 2) responsive to determining that the return instruction is present in the first specific number of bytes of the identified exception handler, analyzing instructions of the identified exception handler that are positioned prior to the return instruction, thereby determining whether the analyzed instructions that are positioned prior to the return instruction modify a value of a stack pointer so as to shrink the stack, and adjudicating the identified exception handler to be legitimate or to be fake based on whether the analyzed instructions that are positioned prior to the return instruction modify the value of the stack pointer so as to shrink the stack.