Patent ID: 8307435

Claim:
A computer-implemented method of a security module of a computer system detecting software object corruption of legitimate software applications, comprising: monitoring an execution of a legitimate software application launched by the computer system; diverting the execution of the legitimate software application to the security module responsive to monitoring the execution of the legitimate software application; identifying a pointer of a software object created by the legitimate software application, a value of the pointer comprising an address of a virtual method table that comprises addresses of methods associated with the software object; examining the value of the pointer and the addresses in the virtual method table, wherein the examination comprises at least one of: determining whether the value of the pointer or an address in the virtual method table comprises a NULL pointer value; and determining whether the value of the pointer, the address in the virtual method table, or data stored at the addresses in the virtual method table comprises a bit pattern indicating heap spray; determining that the software object is corrupted responsive to a determination that the value of the pointer or the address in the virtual method table comprises the NULL pointer value or responsive to a determination that the value of the pointer, the address in the virtual method table, or the data stored at the addresses in the virtual method table comprises the bit pattern indicating heap spray; and responsive to the determination that the software object created by the legitimate software application is corrupted, applying a corrective action.