Selective Export Address Table Filtering for Shellcode Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively prevent unauthorized access and control of devices by malicious shellcode, which often use linear search methods to identify APIs in operating systems, differing from authorized applications' binary search processes.
Innovation Solution
An address table filtering module is loaded into the memory space of a target process to identify and modify the memory addresses of exported function names, registering an exception handler to detect and respond to access violations, thereby filtering out unauthorized access attempts by modifying only a subset of function name RVAs to point to protected memory locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory addresses of all exported function names are modified to point to protected memory locations, then security against unauthorized access is improved, but processing overhead and system performance deteriorate
Solution Approach 1:
The patent applies local quality by selectively modifying only certain memory addresses of exported function names rather than all addresses. Specifically, it modifies addresses based on local characteristics such as whether they fall within vulnerable API ranges or exhibit patterns consistent with linear search exploitation, thereby providing targeted security without universal overhead
Solution Approach 2:
The patent implements partial action by modifying a subset of function name RVAs (relative virtual addresses) rather than the complete set. The exception handler selectively intervenes only when access patterns suggest exploitation attempts, allowing legitimate binary search operations to proceed unimpeded while blocking malicious linear search access to critical APIs
2Measurement precision
If exception handlers are registered to process all accesses to exported function names, then detection precision of exploit attempts is improved, but computational overhead increases
Solution Approach 1:
The patent applies preliminary action by pre-modifying selected function name RVAs to point to protected memory locations before exploitation attempts occur. This proactive setup allows the exception handler to quickly detect violations without performing complex analysis during actual access, reducing real-time computational overhead while maintaining high detection precision
Solution Approach 2:
The patent uses protected memory locations as intermediaries between the exception handler and actual API implementations. When access violations occur, the intermediary protected memory intercepts the attempt and redirects to the exception handler, enabling precise detection without requiring the handler to directly monitor all function accesses
3Reliability
If all function name RVAs are modified to point to protected memory locations, then unauthorized access prevention is improved, but system performance and execution speed deteriorate
Solution Approach 1:
The patent applies local quality by modifying only specific function name RVAs that are most vulnerable to exploitation, such as those within known vulnerable API ranges or that exhibit patterns consistent with linear search attacks. This selective approach prevents unauthorized access to critical functions while avoiding overhead on frequently accessed legitimate APIs
Solution Approach 2:
The patent segments the set of function name RVAs into protected and unprotected subsets based on vulnerability assessment. By dividing the address space and applying different protection levels to different segments, the system achieves strong security for critical APIs while maintaining high execution speed for legitimate operations in unprotected segments
Data Source
AI summary
Examples of the present disclosure describe systems and methods for selective export address table filtering. In aspects, the relative virtual address (RVA) of exported function names may be modified to point to a protected memory location. An exception handler may be registered to process exceptions relating to access violations of the protected memory location. If an exception is detected that indicates an attempt to access the protected memory location, the instruction pointer of the exception may be compared to an allowed range of memory addresses. If the instruction pointer address is outside the boundaries, remedial action may occur.