Abstract:
Various embodiments enhance protections against stack buffer overflow attacks in a computing device by dynamically updating stack canaries. Canary values on the stack of a child process may be replaced with new canary values in response to determining that a condition for generating new canary values is satisfied. Canary values on the stack of a child process may be replaced with new canary values when a child process is forked following a crash of a previous child process of the parent process. Canary values on the stack of a child process may be replaced with new canary values in response to expiration of a canary timeout time. The locations of the canaries to replace may be determined by walking the stack to locate entries in each stack frame that match a previous value of the canary or by walking the stack according to a predefined stack frame format.
Abstract:
Methods, devices, and systems for automatically determining how an application program may be partitioned and offloaded for execution by a general purpose applications processor and an auxiliary processor (e.g., a DSP, GPU, etc.) within a mobile device. The mobile device may determine the portions of the application code that are best suited for execution on the auxiliary processor based on pattern-matching of directed acyclic graphs (DAGS). In particular, the mobile device may identify one or more patterns in the code, particularly in a data flow graph of the code, comparing each identified code pattern to predefined graph patterns known to have a certain benefit when executed on the auxiliary processor (e.g., a DSP). The mobile device may determine the costs and/or benefits of executing the portions of code on the auxiliary processor, and may offload portions that have low costs and/or high benefits related to the auxiliary processor.
Abstract:
Embodiments include computing devices, apparatus, and methods implemented by the apparatus for implementing profile guided indirect jump checking on a computing device, including encountering an indirect jump location of implementing an indirect jump during execution of a program, identifying an indirect jump target of the indirect jump, determining whether the indirect jump location and the indirect jump target are associated in a profile guided indirect jump table, and determining whether the indirect jump location and the indirect jump target are associated in a compiler guided indirect jump table in response to determining that the indirect jump location and the indirect jump target are not associated in the profile guided indirect jump table.
Abstract:
Methods, systems, and devices detect and block execution of malicious shell commands requested by a software application. Various embodiments may include receiving a request from a software application to execute a shell command and simulating execution of the shell command to produce execution behavior information. The computing device may analyze system activities to produce execution context information and generate an execution behavior vector based, at least in part, on the execution behavior information and the execution context information. The computing device may use a behavior classifier model to determine whether the shell command is malicious. In response to determining that the shell command is malicious, the computing device may block execution of the shell command.
Abstract:
Embodiments include computing devices, apparatus, and methods implemented by the apparatus for implementing profile guided indirect jump checking on a computing device, including encountering an indirect jump location of implementing an indirect jump during execution of a program, identifying an indirect jump target of the indirect jump, determining whether the indirect jump location and the indirect jump target are associated in a profile guided indirect jump table, and determining whether the indirect jump location and the indirect jump target are associated in a compiler guided indirect jump table in response to determining that the indirect jump location and the indirect jump target are not associated in the profile guided indirect jump table.
Abstract:
Methods, devices, and systems for automatically determining how an application program may be partitioned and offloaded for execution by a general purpose applications processor and an auxiliary processor (e.g., a DSP, GPU, etc.) within a mobile device. The mobile device may determine the portions of the application code that are best suited for execution on the auxiliary processor based on pattern-matching of directed acyclic graphs (DAGS). In particular, the mobile device may identify one or more patterns in the code, particularly in a data flow graph of the code, comparing each identified code pattern to predefined graph patterns known to have a certain benefit when executed on the auxiliary processor (e.g., a DSP). The mobile device may determine the costs and/or benefits of executing the potions of code on the auxiliary processor, and may offload portions that have low costs and/or high benefits related to the auxiliary processor.