Detecting heap and stack execution in the operating system using regions

No: 7484239
Application no: 11000817
Filed date: 2004-11-30
Issue date: 2009-01-27
Kind: B1
Claims: 20
Drawing sheets: 5
Abstract: A call to a critical operating system function is stalled. The pregion and pregion type associated with the location of a call module originating the call is determined. In one embodiment, when the pregion type is either a stack or a heap pregion type, protective action is taken, such as terminating the call, otherwise the call is released. In another embodiment, when the pregion type is either a text or shared memory pregion type, the call is released, otherwise protective action is taken.
Inventors:
	Tester Jonathan  (2)
	Verma Sunita  (1)
Primary examiner: Zand Kambiz
Assistant examiner: Jackson Jenise E
Agents:
	Gunnison, McKay & Hodgson, L.L.P. (ORG)  (267)
	Hodgson Serge J.  (80)
Assignees:
	Symantec Corporation (ORG)  (133)
Field of search:
	No:164 - Security kernel or utility
Other references:
	“HP-UX Memory Management White Paper, Version 1.3”, Hewlett-Packard Company, Apr. 7, 1997, pp. 1-116 [online]. Retrieved from the Internet: .
	“HP-UX Process Management White Paper, Version 1.3”, Hewlett-Packard Company, Apr. 7, 1997, pp. 1-124 [online]. Retrieved from the Internet:.
	Szor, P., U.S. Appl. No. 10/681,623, filed Oct. 7, 2003 and entitled “Unmapped Code Blocking System and Method”.
	“Memory Management White Paper, Version 1.3”, Hewlett-Packard Company, Apr. 7, 1997, pp. 1-116 [online]. Retrieved from the Internet:.
References:
	6412071 - Method for secure function execution by calling address validation