会员体验
专利管家(专利管理)
工作空间(专利管理)
风险监控(情报监控)
数据分析(专利分析)
侵权分析(诉讼无效)
联系我们
交流群
官方交流:
QQ群: 891211   
微信请扫码    >>>
现在联系顾问~
热词
    • 1. 发明申请
    • TECHNOLOGIES FOR CONTROL FLOW EXPLOIT MITIGATION USING PROCESSOR TRACE
    • 使用处理器跟踪控制流量开采减少的技术
    • US20160283714A1
    • 2016-09-29
    • US14670988
    • 2015-03-27
    • Michael LeMayRavi L. SahitaBeeman C. StrongThilo SchmittYuriy BulyginMarkus T. Metzger
    • Michael LeMayRavi L. SahitaBeeman C. StrongThilo SchmittYuriy BulyginMarkus T. Metzger
    • G06F21/56G06F21/44
    • G06F21/56G06F21/44G06F21/52
    • Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.
    • 用于控制流利用减轻的技术包括具有具有实时指令跟踪支持的处理器的计算设备。 在处理过程中,处理器产生指示过程控制流的跟踪数据。 计算设备分析跟踪数据以识别可疑的控制流攻击。 计算设备可以使用启发式算法来识别返回导向的编程漏洞。 计算设备可以基于跟踪数据来维护阴影栈。 计算设备可以基于跟踪数据来识别对未授权地址的间接分支,以识别面向跳跃的编程漏洞。 每当进程被抢占时,计算设备可以检查跟踪数据。 处理器可以实时地检测错误的返回指令,并且在该过程的过程空间中调用软件处理程序以验证和维护该影子栈。 描述和要求保护其他实施例。
    • 4. 发明申请
    • TRACKING MODE OF A PROCESSING DEVICE IN INSTRUCTION TRACING SYSTEMS
    • 指令跟踪系统中处理设备的跟踪模式
    • US20150006717A1
    • 2015-01-01
    • US14126313
    • 2013-06-27
    • Thilo SchmittPeter LachnerBeeman StrongOfer LevyThomas TollMatthew MertenTong LiRavi RajwarKonrad Lai
    • Thilo SchmittPeter LachnerBeeman StrongOfer LevyThomas TollMatthew MertenTong LiRavi RajwarKonrad Lai
    • H04L12/26
    • G06F9/30189G06F11/3636
    • In accordance with embodiments disclosed herein, there is provided systems and methods for tracking the mode of processing devices in an instruction tracing system. The method may include receiving an indication of a change in a current execution mode of the processing device. The method may also include determining that the current execution mode of the received indication is different than a value of an execution mode of a first execution mode (EM) packet previously-generated by the IT module. The method may also include generating, based on the determining that the current execution mode is different, a second EM packet that provides a value of the current execution mode of the processing device to indicate the change in the execution mode for an instruction in a trace generated by the IT module. The method may further include generating transactional memory (TMX) packets having n bit mode pattern in the packet log. The n is at least two and the n bit mode indicates transaction status of the TMX operation.
    • 根据本文公开的实施例,提供了用于跟踪指令跟踪系统中的处理设备的模式的系统和方法。 该方法可以包括接收处理设备的当前执行模式中的改变的指示。 该方法还可以包括确定接收到的指示的当前执行模式不同于IT模块先前生成的第一执行模式(EM)分组的执行模式的值。 该方法还可以包括基于确定当前执行模式不同而生成第二EM分组,其提供处理设备的当前执行模式的值以指示用于跟踪中的指令的执行模式的改变 由IT模块生成。 该方法还可以包括在分组日志中生成具有n位模式模式的事务存储器(TMX)分组。 n至少为2,n位模式表示TMX操作的事务状态。