NOP sled defense

Patent metadata

Field	Value
Publication number	US-11036654-B2
Application number	US-201816014442-A
Country	US
Kind code	B2
Filing date	Jun 21, 2018
Priority date	Apr 14, 2018
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

The disclosed technology is generally directed to protection against unauthorized code. In one example of the technology, a read request to a restricted region of memory is detected. The read request is associated with a first processor. In response to detecting the read request to the restricted region of memory, a data value that causes an exception in response to execution by the first processor is provided.

First claim

We claim:

1. An apparatus, comprising:
a device that is adapted to perform actions, including:
detecting a read request to a restricted region of memory, wherein the read request is associated with a first processor;
in response to detecting the read request to the restricted region of memory, providing, as data read by the read request in lieu of reading data in the restricted region of memory, a data value;
receiving an instruction to execute the data value; and
via the first processor, executing the data value responsive to the instruction to execute the data value, the execution of the data value causing an exception.

2. The apparatus of claim 1 , the actions further including, in response to detecting the read request to an unmapped region of memory, providing a data value that causes an exception in response to execution by the first processor.

3. The apparatus of claim 1 , wherein the device further includes a firewall, and wherein the restricted region of memory is restricted by the firewall.

4. The apparatus of claim 1 , the actions further including:
detecting a read request to a restricted region of memory, wherein the read request is associated with the first processor; and
in response to detecting the read request to the restricted region of memory, providing a data value that causes an infinite loop or a data value that causes a branch to logging detection of the read request.

5. The apparatus of claim 1 , the actions further including determining the data value that causes an exception in response to execution by the first processor based on a look-up table and an indication of the first processor as an input to the look-up table.

6. The apparatus of claim 1 , wherein the read request is associated with the first processor via a master identifier (ID) that is associated with the read request.

7. The apparatus of claim 1 , wherein the device further includes a second processor, and wherein the data value also causes an exception in response to execution by the second processor.

8. An apparatus, comprising:
a device that is adapted to perform actions, including:
detecting a read request to a restricted region of memory, wherein the read request is associated with a first processor;
in response to detecting the read request to the restricted region of memory, providing, as data read by the read request in lieu of reading data in the restricted region of memory, a data value;
receiving an instruction to execute the data value; and
via the first processor, executing the data value responsive to the instruction to execute the data value, the execution of the data value causing at least one of an infinite loop or a branch to logging detection of the read request.

9. The apparatus of claim 8 , the actions further including, in response to detecting a read request to an unmapped region of memory, providing a data value that causes an infinite loop or a data value that causes a branch to logging detection of the read request in response to execution by the first processor.

10. The apparatus of claim 8 , wherein the device further includes a firewall, and wherein the restricted region of memory is restricted by the firewall.

11. The apparatus of claim 8 , the actions further including:
detecting a read request to a restricted region of memory, wherein the read request is associated with the first processor; and
in response to detecting the read request to the restricted region of memory, providing a data value that causes an exception in response to execution by the first processor.

12. The apparatus of claim 8 , the actions further including determining the data value that causes an infinite loop or a data value that causes a branch to logging detection of the read request by the first processor based on a look-up table and an indication of the first processor as an input to the look-up table.

13. The apparatus of claim 8 , wherein the read request is associated with the first processor via a master identifier (ID) that is associated with the read request.

14. The apparatus of claim 8 , wherein the device further includes a second processor, and wherein the data value also causes an infinite loop or a data value that causes a branch to logging detection of the read request in response to execution by the second processor.

15. A method, comprising:
detecting that a read request is a read request to a restricted region of memory, wherein the read request is associated with a first processor;
responsive to detecting the read request to the restricted region of memory, providing, as data read by the read request in lieu of reading data in the restricted region of memory, a data value;
receiving an instruction to execute the data value; and
via the first processor, executing the data value responsive to the instruction to execute the data value, the execution of the data value causing an exception.

16. The method of claim 15 , further comprising, in response to detecting a read request to an unmapped region of memory, providing a data value that causes an exception in response to execution by the first processor.

17. The method of claim 15 , wherein the restricted region of memory is restricted by a firewall.

18. The method of claim 15 , further comprising:
detecting the read request to a restricted region of memory, wherein the read request is associated with a first processor; and
in response to detecting the read request to the restricted region of memory, providing a data value that causes an infinite loop or a data value that causes a branch to logging detection of the read request.

19. The method of claim 15 , wherein the read request is associated with the first processor via a master identifier (ID) that is associated with the read request.

20. The method of claim 15 , wherein the data value also causes an exception in response to execution by a second processor.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Letey George Thomas
• Domke Felix Stefan
• Nightingale Edmund B

Classifications

• G06F12/1441

  for a range · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F2212/1052

  Security improvement · CPC title

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title