System and Method for Detecting Branch Oriented Programming Anomalies

摘要

Systems, methods and media are shown for detecting branch oriented program code involving searching one or more pages of memory to identify a list of code pointers. They also involve, for each code pointer in the list of code pointers, disassembling a segment of code corresponding to the code pointer, determining whether the segment of code terminates in a branch instruction, and removing the segment of code from the list if it does not terminate in a branch instruction. For each remaining code pointer in the list of code pointers, they involve searching a predetermined window of code to determine whether the branch instruction and a target address of the branch instruction both fall within the window, and removing the code pointer from the list if the branch instruction and target address are not both within the window.