Some content of this application is unavailable at the moment.
If this situation persist, please contact us atFeedback&Contact
1. (WO2017112273) DETECTING DATA CORRUPTION BY CONTROL FLOW INTERCEPTIONS
Latest bibliographic data on file with the International Bureau

Pub. No.: WO/2017/112273 International Application No.: PCT/US2016/063439
Publication Date: 29.06.2017 International Filing Date: 23.11.2016
IPC:
G06F 21/50 (2013.01) ,G06F 21/54 (2013.01)
G PHYSICS
06
COMPUTING; CALCULATING; COUNTING
F
ELECTRIC DIGITAL DATA PROCESSING
21
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
50
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
G PHYSICS
06
COMPUTING; CALCULATING; COUNTING
F
ELECTRIC DIGITAL DATA PROCESSING
21
Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
50
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
52
during program execution, e.g. stack integrity, buffer overflow or preventing unwanted data erasure
54
by adding security routines or objects to programs
Applicants:
MCAFEE, LLC [US/US]; 2821 Mission College Boulevard Santa Clara, California 95054-1838, US
Inventors:
LI, Xiaoning; US
LU, Lixin; US
SAHITA, Ravi; US
Agent:
GUPTA, Rishi; US
Priority Data:
14/998,20124.12.2015US
Title (EN) DETECTING DATA CORRUPTION BY CONTROL FLOW INTERCEPTIONS
(FR) DÉTECTION DE CORRUPTION DE DONNÉES PAR INTERCEPTIONS DE FLUX DE COMMANDE
Abstract:
(EN) Embodiments of this disclosure are directed to an execution profiling handler configured for intercepting an invocation of memory allocation library and observing memory allocation for an executable application process. The observed memory allocation can be used to update memory allocation meta-data for tracking purposes. The execution profiling handler can also intercept indirect branch calls to prevent heap allocation from converting to execution and intercept exploitation of heap memory to block execution.
(FR) La présente invention concerne, dans certains modes de réalisation, un gestionnaire de création de profils d'exécution configuré pour intercepter une invocation de bibliothèque d'allocation de mémoire et observer l'allocation de mémoire en vue d'un processus d'application exécutable. L'allocation de mémoire observée peut être utilisée pour mettre à jour des métadonnées d'allocation de mémoire à des fins de suivi. Le gestionnaire de création de profils d'exécution peut également intercepter des appels de branchement indirect pour empêcher une allocation de pile d'être convertie en exécution et intercepter l'exploitation d'une mémoire de pile afin de bloquer l'exécution.
front page image
Designated States: AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW
African Regional Intellectual Property Organization (ARIPO) (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW)
Eurasian Patent Organization (AM, AZ, BY, KG, KZ, RU, TJ, TM)
European Patent Office (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR)
African Intellectual Property Organization (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG)
Publication Language: English (EN)
Filing Language: English (EN)