System, method and computer program product for verifying invocations of interfaces

• US 7,987,451 B1
• Filed: 11/20/2006
• Issued: 07/26/2011
• Est. Priority Date: 11/20/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory William
• Primary Examiner(s): Pham; Thomas K
• Application Number:
  US11/561,809
• Time in Patent Office: 1,709 Days
• Field of Search: 717/126
• US Class Current: 717/126
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 9/4484 Executing subprograms

Abstract

A verification system, method and computer program product are provided. In one embodiment, one of a plurality of call instruction formats is selected. In addition, it is verified whether an invocation of an interface was attempted by code utilizing the selected call instruction format. Further, the selection and the verification are repeated for each of the plurality of call instruction formats. In another embodiment, a return target address is identified. Still yet, it is determined whether return of contra to the return target address would result in invocation a one of a plurality of interfaces.

Claims

1. A method, comprising:

selecting one of a plurality of call instruction formats; and

verifying whether an invocation of an interface was attempted by code utilizing the selected call instruction format, utilizing a processor;

wherein the selecting and verifying are repeated for each of the plurality of call instruction formats.

2. The method of claim 1, and further comprising intercepting the invocation of the interface.

3. The method of claim 1, and further comprising storing the code that attempted the invocation of the interface.

4. The method of claim 1, wherein the code is identified utilizing a return address associated with the attempted invocation.

5. The method of claim 4, wherein a target address associated with the code is identified based on the return address and the selected call instruction format.

6. The method of claim 5, wherein the verifying further includes determining whether the target address matches an address associated with the interface.

7. The method of claim 6, wherein the attempted invocation of the interface is conditionally allowed to continue based on the determination.

8. The method of claim 5, wherein a jump instruction associated with the target address is identified.

9. The method of claim 8, wherein the verifying further includes determining whether a jump target address associated with the jump instruction matches an address associated with the interface.

10. The method of claim 1, wherein each of the plurality of the call instruction formats includes a template.

11. The method of claim 10, wherein each template defines a length of a call instruction.

12. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code for selecting one of a plurality of call instruction formats; and

computer code for verifying whether an invocation of an interface was attempted by code utilizing the selected call instruction format;

wherein the computer program product is operable such that the selecting and verifying are repeated for each of the plurality of call instruction formats.

13. A system, comprising:

a processor for selecting one of a plurality of call instruction formats, the processor further adapted for verifying whether an invocation of an interface was attempted by code utilizing the selected call instruction format;

wherein the system is operable such that the selecting and verifying are repeated for each of the plurality of call instruction formats.

14. The system of claim 13, further comprising a display and memory coupled to the processor via a bus.

15. A method, comprising:

identifying a return target address; and

determining whether return of control to the return target address would result in invocation of one of a plurality of interfaces, utilizing a processor.

16. The method of claim 15, and further comprising skipping a plurality of instructions pointed to by the return target address.

17. The method of claim 16, wherein the plurality of instructions include no operation instructions.

18. The method of claim 15, and further comprising identifying an additional return target address.

19. The method of claim 18, wherein the determining further includes determining whether the additional return target address matches an address associated with one of the plurality of interfaces.

20. The method of claim 15, wherein invocation of an interface by code associated with the return target address is intercepted.

21. The method of claim 15, wherein invocation of an interface by code associated with the return target address is conditionally allowed to continue based on the determination.

22. The method of claim 15, wherein the plurality of interfaces are stored in a watch list.

23. The method of claim 15, wherein a violation event is conditionally performed based on the determination.

24. The method of claim 15, wherein a jump instruction associated with the additional return target address is identified.

25. The method of claim 24, wherein the determining further includes determining whether a jump target address associated with the jump instruction matches an address associated with one of the plurality of interfaces.