Preventing Hash-Based API Importing via Memory Guard Pages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively prevent malicious software from resolving the location of operating system APIs, particularly through hash-based API importing, which allows malicious actors to evade detection by using hash collisions and different hashing algorithms.
Innovation Solution
Allocating a name page and a guard page in memory, associated with the operating system's address arrays, and filling the name page with non-zero characters while setting the guard page to no access, causing memory access violations when malicious software attempts to access the guard page, thereby terminating the program.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If hash-based API importing is allowed, then software flexibility and functionality are improved, but security against malicious software deteriorates
Solution Approach 1:
The system performs preliminary actions by allocating and filling the name page with non-zero characters and setting up the guard page with no-access protections before any API importing operations occur. This preemptive configuration ensures that when hash-based API importing is attempted, the malicious code will inevitably encounter the protected guard page, thereby preventing execution before harm can occur while still allowing legitimate API imports to function.
2Object-affected harmful factors
If memory access protections are increased, then security against malicious software is improved, but system reliability and program stability deteriorate
Solution Approach 1:
Instead of applying memory access protections system-wide, the invention applies no-access protections locally and selectively only to the guard page that immediately follows the name page in memory. This localized approach ensures that legitimate programs accessing valid API names are unaffected, while malicious programs attempting to access protected areas encounter the guard page and are terminated, thus maintaining system reliability while enhancing security.
3Object-affected harmful factors
If the name page is filled with non-zero characters, then detection of malicious software is improved, but memory usage and system resources increase
Solution Approach 1:
The system applies partial action by filling only the name page with non-zero characters rather than protecting entire memory spaces. The name page size is sufficient to detect malicious hash-based API importing attempts (which typically scan through memory looking for API names), yet the scope is limited enough to avoid excessive memory consumption. This balanced approach provides effective detection while maintaining reasonable resource usage.
Data Source
AI summary
Hash-based application programming interface (API) importing can be prevented by allocating a name page and a guard page in memory. The name page and the guard page being associated with (i) an address of names array, (ii) an address of name ordinal array, and (iii) an address of functions array that are all generated by an operating system upon initiation of an application. The name page can then be filled with valid non-zero characters. Thereafter, protections on the guard page can be changed to no access. An entry is inserted into the address of names array pointing to a relative virtual address corresponding to anywhere within the name page. Access to the guard page causes the requesting application to terminate. Related apparatus, systems, techniques and articles are also described.