Using Assured Calling Sequences in Micro-Sandboxes

摘要

The present disclosure relates to methods, systems, and devices that use assured calling sequences to validate proper application behavior. Validating calling sequences ensures that attackers have not modified the process' stack to gain control of the execution path for critical operations. The validation may involve mapping calling sequence addresses to modules or functions present in the process. Additionally, some embodiments relate to eliminating unnecessary code from various modules and controlling which modules can be loaded into a program.

主权项

1. A method of validating application behavior, comprising:
intercepting a function call; obtaining a calling sequence associated with the function call; determining that the obtained calling sequence matches at least a portion of an assured calling sequence (ACS); and allowing the function call to execute based at least on the determination that the obtained calling sequence matches at least a portion of the ACS.