Electrical computers and digital processing systems: support – Data processing protection using cryptography – By stored data protection
Reexamination Certificate
2004-03-05
2010-06-15
Smithers, Matthew B (Department: 2437)
Electrical computers and digital processing systems: support
Data processing protection using cryptography
By stored data protection
C713S170000, C713S187000, C719S331000, C717S127000, C717S163000
Reexamination Certificate
active
07739516
ABSTRACT:
The import address table of a software module is verified in order to prevent detouring attacks. A determination is made regarding which entries in the IAT must be verified; all of the entries may be verified or some subset of the entries that are critical may be verified. For each external function, the external module containing the external function is loaded, if it is not already loaded. The function address in the exported function table is found. That address is compared to the address for the function in the IAT. Additionally, the external module, in one embodiment, is verified to ensure that it has not been modified. For a delay load IAT, a similar procedure is followed; however the delay load IAT may be periodically checked to ensure that the delay load IAT entries are either valid (indicating that the external function has been bound) or in their initial state (indicating that no binding has yet occurred).
REFERENCES:
patent: 6253258 (2001-06-01), Cohen
patent: 6802006 (2004-10-01), Bodrov
patent: 7360097 (2008-04-01), Rothstein
patent: 2005/0108562 (2005-05-01), Khazan et al.
Marchesini et al. “Keyjacking: Risks of the Current Client-side Infrastructure”, 2nd Annual PKI Research Workshop, Apr. 21, 2003.
Hunt, G. et al., “Detours: Binary Interception of Win32 Functions”,Proceedings of the 3rdUSENIX Windows NT Symposium, Jul. 1999, Seattle, WA., 1-9.
Leman, D., “Spying on COM Objects”, Jul. 1999, 10(7), http://www.windevnet.com/wdm/articles/1999/9907/, 1 page.
Pietrek, M., “Under The Hood”, http://microsoft.com/msj/0200/hood0200.aspx, Feb. 2000, 9 pages.
Brender Scott A.
Lafornara Philip J.
Marr Michael David
Oliver Robert Ian
Gelagay Shewaye
Microsoft Corporation
Smithers Matthew B
Woodcock & Washburn LLP
LandOfFree
Import address table verification does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Import address table verification, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Import address table verification will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-4217745