Detecting a return-oriented programming exploit

Patent metadata

Field	Value
Publication number	US-8997218-B2
Application number	US-92890510-A
Country	US
Kind code	B2
Filing date	Dec 22, 2010
Priority date	Dec 22, 2010
Publication date	Mar 31, 2015
Grant date	Mar 31, 2015

Abstract

A method and apparatus for detecting a Return-Oriented Programming exploitation. At a computer device, a mechanism to detect a control transfer of a code location in a memory is established. This may be, for example, hooking the control transfer. The code location relates to an electronic file. In the event that a control transfer of the code location is detected, a comparison is made between a destination code location address with values in the freed stack. If the code location address matches any of the values in the freed stack, then it is determined that the control transfer of the code location relates to a Return-Oriented Programming exploitation.

First claim

The invention claimed is:

1. A method of detecting a Return Oriented Programming exploitation of an application, the method comprising, at a computer device:
establishing a hooking rule to hook a code location relating to an electronic file stored in a computer readable medium in the form of a memory;
in the event that a control transfer of the code location relating to the electronic file is detected, comparing a code location address with values in a stack space freed by the c…

Assignees

• Hentunen Daavid
• F Secure Corp

Inventors

• Hentunen Daavid

Classifications

• G06F21/54 Primary

  Physics · mapped topic

• G06F2221/033

  Physics · mapped topic

• G06F21/577 Primary

  Physics · mapped topic