13 results about "Shellcode" patented technology

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

A computer-implemented method 300 and system comprises (a) detecting discovery, by code running in an application buffer, of malicious code in application memory 301; and responsive thereto: (b) preve

One or more embodiments of the invention provide a malicious program detection method and apparatus. The method comprises the steps of obtaining a to-be-detected Webshell code of a network shell; identifying a target method which is indirectly called or implicitly called from the Webshell code, and determining the type of a target object calling the target method; in response to determining that the security detection platform needs to execute sensitive operation in the process of calling the target method in the target object type, triggering a malicious alarm for the target object type; wherein the malicious alarm is used for representing that the Webshell code is a malicious code. According to the method, the target methods of indirect calling and implicit calling in the Webshell code are recognized, and the sensitive operation of each target object type when the target methods are called is detected, so that the malicious code can be accurately recognized.

A method for detecting exploits involving shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify memory blocks containing suspect shellcode. The memory blocks are dumped into memory to identify candidate shellcode entry points associated with the suspect shellcode. Based on the candidate shellcode entry points, the suspect shellcode is executed to determine whether the suspect shellcode is malicious. A verdict is generated for the sample based on a result of executing the suspect shellcode.

Detection of an exploit including shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify a memory block including suspicious shellcode. The memory block is dumped in memory to identify a candidate shellcode entry point associated with the suspicious shellcode. The suspicious shellcode is executed based on the candidate shellcode entry point to determine whether the suspicious shellcode is malicious. A verdict is generated regarding the sample based on results of executing the suspicious shellcode.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The present application belongs to the network security technical field, especially a kind of Windowsx86 under the positioning and extraction method of shellcode in stack space, comprising: hooking system API function, after hitting, the function of being hooked is carried out stack backtracking, every backtracking one level stack frame, it is checked to the position that the return address of this level points to, see whether the position belongs to stack space, when checking that the return address of certain level points to stack space inside, address value is noted down, and the EBP value of the nearest level in address decreasing direction is noted down, then backtracking one level obtains the EBP value of current stack frame;In order to further confirm the boundary of extraction;According to the boundary range determined, binary data is extracted, and binary data is identified as x86 assembly, and the real code will be contained therein.The present application can realize the positioning and extraction of shellcode in an intuitive and fast way, and improve the accuracy of extraction.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.

The invention discloses a precise penetration test method and system for a very simple kernel VxWorks system, and the method comprises the steps: transmitting a lightweight detection packet based on a UDP protocol to a target VxWorks system, and obtaining the initial fingerprint information of the target system through analyzing the response of the target VxWorks system to the lightweight detection packet; aiming at the initial fingerprint information, sending a targeted detection request to the target VxWorks system, and accurately identifying the version number and / or patch level of the target VxWorks system by analyzing the response of the target VxWorks system; sending a special request to the target VxWorks system by using the identified vulnerability, triggering the vulnerability and implanting a'shellcode 'to obtain a remote code execution permission of the target VxWorks system; and establishing a remote control channel with low resource consumption by utilizing a file transmission function of the target VxWorks system on the basis of the remote code execution permission, so as to realize stable control on the target VxWorks system. According to the invention, efficient and accurate identification of the target system and utilization of security vulnerabilities can be realized.

A method, storage system, and computer program product for protecting a computing device, including a processor and memory, and connected to a storage device that stores a set of one or more files. A call to a function designated for execution by the processor is detected, and a stack trace for the call to the designated function is generated in memory. When the stack trace detects a stack frame containing a return address that references a shellcode region in memory, where the shellcode region contains executable code that was not loaded from any given file on the storage device, the referenced executable code is then compared against a list of malicious shellcodes. Finally, when a match is found between the referenced executable code and one of the malicious shellcodes in the list, preventive action is initiated.

Kernel-mode security software detects a trigger event indicative of a specific stage in the lifecycle of a target software entity executing in user mode. In response, the security software identifies a target object residing in memory (e.g., loaded library, chunk of code, etc.) according to a current content of the user-mode call stack, and determines whether the target object is malicious. Various methods described herein detect malicious modifications of a loaded module, such as overload, stomping, and unhooking, among others. Other methods described herein detect dynamically swapped libraries and malicious shellcode, among others.