US7281271B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Exception handling validation system and method
Assignee: CA Inc
•
Filing: 2003-09-25
•
Granted: 2007-10-09
•
Expires: 2023-09-25
Abstract
Abstract A method includes determining whether the exception handling frames on the stack are uncorrupt prior to execution of an exception handler dispatcher. Upon a determination that the exception handling frames on the stack are uncorrupt, the method further includes allowing the execution of the exception handler dispatcher to proceed. Conversely, upon a determination that the exception handling frames on the stack are corrupt, protective action is taken to prevent the malicious code on the host computer system from exploiting and/or damaging the host computer system.
Inventors
- 👤 Peter Szor
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 21:37
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/52
Claims Analysis
Total Claims: 28
Claim 1
Independent Claim
54 words
A method comprising: hooking an exception handler dispatcher; stalling execution of said exception handler dispatcher upon invocation of said exception handler dispatcher; and determining whether an exception handling is valid, wherein upon a determination that said exception handling is valid, said method further comprising allowing said execution of said exception handler dispatcher to proceed.
Claim 2
Independent Claim
54 words
A method comprising: hooking an exception handler dispatcher; stalling execution of said exception handler dispatcher upon invocation of said exception handler dispatcher; and determining whether an exception handling is valid, wherein upon a determination that said exception handling is valid, said method further comprising allowing said execution of said exception handler dispatcher to proceed.
Claim 3
Dependent Claim
24 words
The method of claim 1 wherein said determining whether an exception handling is valid comprises: determining whether exception handler frame addresses are in order.
Claim 4
Dependent Claim
38 words
The method of claim 2 wherein said determining whether exception handler frame addresses are in order comprises determining whether said exception handler frame addresses are successively increasing from a first exception handler frame located highest on a stack.
Claim 5
Dependent Claim
27 words
The method of claim 1 wherein said determining whether an exception handling is valid comprises: determining whether an exception handler is in a data area of memory.
Claim 6
Dependent Claim
38 words
The method of claim 4 wherein said determining whether an exception handler is in a data area of memory comprises determining whether a handler address in an exception handler frame points to a page in said data area.
Claim 7
Dependent Claim
25 words
The method of claim 1 wherein said determining whether an exception handling is valid comprises: determining whether a previous exception handler frame address is invalid.
Claim 8
Dependent Claim
38 words
The method of claim 6 wherein said determining whether a previous exception handler frame address is invalid comprises determining whether said previous exception handler frame address in an exception handler frame points to a page that is invalid.
Claim 9
Dependent Claim
36 words
The method of claim 1 wherein exception handler frames form a linked list, said determining whether an exception handling is valid comprises: determining whether exception handler frame addresses of said exception handler frames are in order.
Claim 10
Dependent Claim
52 words
The method of claim 8 wherein said determining whether exception handler frame addresses of said exception handler frames are in order comprises determining whether said exception handler frame addresses are successively increasing from a first exception handler frame located highest on a stack, said linked list comprising said first exception handler frame.
Claim 11
Dependent Claim
40 words
The method of claim 1 wherein exception handler frames form a linked list, said determining whether an exception handling is valid comprises: determining whether any exception handlers associated with said exception handler frames are in a data area of memory.
Claim 12
Dependent Claim
44 words
The method of claim 10 wherein said determining whether any exception handlers associated with said exception handler frames are in a data area of memory comprises determining whether any handler addresses in said exception handler frames point to a page in said data area.
Claim 13
Dependent Claim
37 words
The method of claim 1 wherein exception handler frames form a linked list, said determining whether an exception handling is valid comprises: determining whether any previous exception handler frame addresses in said exception handler frames are invalid.
Claim 14
Dependent Claim
44 words
The method of claim 12 wherein said determining whether any previous exception handler frame addresses in said exception handler frames are invalid comprises determining whether said any previous exception handler frame addresses in said exception handler frames point to a page that is invalid.
Claim 15
Dependent Claim
26 words
The method of claim 1 wherein upon a determination that said exception handling is not valid during said determining, said method further comprising taking protective action.
Claim 16
Dependent Claim
29 words
The method of claim 14 wherein prior to said taking protective action, said method further comprising determining that said exception handling is not a known false positive exception handling.
Claim 17
Dependent Claim
17 words
The method of claim 14 further comprising providing a notification that said protective action has been taken.
Claim 18
Dependent Claim
15 words
The method of claim 1 wherein said hooking comprises hooking a function called KiUserExceptionDispatcher( ).
Claim 19
Dependent Claim
23 words
The method of claim 1 wherein said hooking comprises modifying said exception handler dispatcher to redirect flow to an exception handling validation module.
Claim 20
Dependent Claim
18 words
The method of claim 18 wherein said modifying comprises inserting a jump instruction into said exception handler dispatcher.
Claim 21
Dependent Claim
18 words
The method of claim 1 further comprising invoking said exception handler dispatcher, said invoking comprising raising an exception.
Claim 22
Independent Claim
67 words
A method comprising: determining that exception handling is valid prior to allowing execution of an exception handler dispatcher, wherein said determining that exception handling is valid is selected from the group of operations consisting of: determining whether exception handler frame addresses are in order; determining whether an exception handler is in a data area of memory; and determining whether a previous exception handler frame address is invalid.
Claim 23
Independent Claim
67 words
A method comprising: determining that exception handling is valid prior to allowing execution of an exception handler dispatcher, wherein said determining that exception handling is valid is selected from the group of operations consisting of: determining whether exception handler frame addresses are in order; determining whether an exception handler is in a data area of memory; and determining whether a previous exception handler frame address is invalid.
Claim 24
Dependent Claim
89 words
A computer program product comprising a tangible computer readable medium containing computer program code comprising: an exception handling validation application for hooking an exception handler dispatcher; said exception handling validation application further for stalling execution of said exception handler dispatcher upon invocation of said exception handler dispatcher; and said exception handling validation application further for determining whether an exception handling is valid, wherein upon a determination that said exception handling is valid, said exception handling validation application further for allowing said execution of said exception handler dispatcher to proceed.
Claim 25
Dependent Claim
89 words
A computer program product comprising a tangible computer readable medium containing computer program code comprising: an exception handling validation application for hooking an exception handler dispatcher; said exception handling validation application further for stalling execution of said exception handler dispatcher upon invocation of said exception handler dispatcher; and said exception handling validation application further for determining whether an exception handling is valid, wherein upon a determination that said exception handling is valid, said exception handling validation application further for allowing said execution of said exception handler dispatcher to proceed.
Claim 26
Dependent Claim
26 words
The computer program product of claim 22 wherein said determining whether an exception handling is valid comprises: determining whether exception handler frame addresses are in order.
Claim 27
Dependent Claim
29 words
The computer program product of claim 22 wherein said determining whether an exception handling is valid comprises: determining whether an exception handler is in a data area of memory.
Claim 28
Dependent Claim
27 words
The computer program product of claim 22 wherein said determining whether an exception handling is valid comprises: determining whether a previous exception handler frame address is invalid.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2010-10-08 | 2011-04-09 | 2011-10-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2014-10-08 | 2015-04-09 | 2015-10-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2018-10-08 | 2019-04-09 | 2019-10-09 | $7700.00 | Window Closed / Lapsed |