Malware Evasion Defense via Code Copying and Guard Pages
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Targeted malware evades detection by security software by manipulating the PsSetCreateProcessNotifyRoutine routine in Microsoft Windows operating systems, disabling antivirus notifications for malware processes.
Innovation Solution
Modifying the PsSetCreateProcessNotifyRoutine code to jump to a substitute routine before accessing potentially vulnerable data structures, and replacing the data structure address with a guard page address to prevent tampering by malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software uses PsSetCreateProcessNotifyRoutine to notify when processes are created, then detection capability is improved, but malware can read the code at runtime, find the binary signature, and remove the callback routine from the list, disabling the notification
Solution Approach 1:
The patent creates a copy of the PsSetCreateProcessNotifyRoutine code and places it in a protected location (such as a system driver or protected memory region). The callback routine list is maintained in this copied version rather than in the original accessible code, making it difficult for malware to locate and tamper with the notification mechanism while preserving antivirus detection functionality
Solution Approach 2:
The patent pre-provides a substitute callback routine in advance that is designed to be resistant to malware tampering. This substitute routine is installed before malware execution and is structured to prevent malware from successfully removing or disabling the notification callback, thereby maintaining detection reliability even when malware attempts to evade detection
Data Source
AI summary
To defend a computer against malware, first executable code, of the computer, that includes a signature that identifies an address, in the computer's memory, of a respective data structure that is potentially vulnerable to tampering, is identified. The first executable code is copied to provide second executable code that emulates the first executable code using its own respective data structure. The first executable code is modified to jump to the second executable code before accessing the data structure, and also so that the signature identifies the address of a guard page.