Abstract: Various automated techniques are described herein for protecting computing devices from malicious code injection and execution by providing a malicious process with incorrect information regarding the type and/or version and/or other characteristics of the operating system and/or the targeted program and/or the targeted computing device. The falsified information tricks the malicious process into injecting shellcode that is incompatible with the targeted operating system, program and/or computing device. When the incompatible, injected shellcode attempts to execute, it fails as a result of the incompatibility, thereby protecting the computing device.

Abstract: Various approaches are described herein for, among other things, detecting and/or neutralizing attacks by malicious code. For example, instance(s) of a protected process are modified upon loading by injecting a runtime protector that creates a copy of each of the process' imported libraries and maps the copy into a random address inside the process' address space to form a “randomized” shadow library. The libraries loaded at the original address are modified into a stub library. Shadow and stub libraries are also created for libraries that are loaded after the process creation is finalized. Consequently, when malicious code attempts to retrieve the address of a given procedure, it receives the address of the stub procedure, thereby neutralizing the malicious code. When the original program's code (e.g., the non-malicious code) attempts to retrieve the address of a procedure, it receives the correct address of the requested procedure (located in the shadow library).

Abstract: The invention relates to a method for providing a computerized system which is protected from unauthorized programs coming from an external source, the method comprises the steps of (a) secretly, and in a manner unknown to authors of external programs, providing a non-standard compiler which mutates (modifies) each high level program to one or more non-standard mutated machine code instructions that a standard CPU cannot properly execute! (b) subjecting all authorized programs to said non-standard compiler; and (c) providing a translator which converts each mutated machine code instruction resulting from said non-standard compiler to a respective standard instruction which the CPU can properly execute, whereas any program which is not subjected to both said non-standard compiler and said translator will result in one or more instructions that the CPU cannot properly execute.

Abstract: The invention relates to a method for providing a computerized system which is protected from unauthorized programs coming from an external source, the method comprises the steps of (a) secretly, and in a manner unknown to authors of external programs, providing a non-standard compiler which mutates (modifies) each high level program to one or more non-standard mutated machine code instructions that a standard CPU cannot properly execute! (b) subjecting all authorized programs to said non-standard compiler; and (c) providing a translator which converts each mutated machine code instruction resulting from said non-standard compiler to a respective standard instruction which the CPU can properly execute, whereas any program which is not subjected to both said non-standard compiler and said translator will result in one or more instructions that the CPU cannot properly execute.

Abstract: The invention relates to a method for providing a computerized system which is protected from malicious programs coming from an external source, the method comprises the steps of (a) secretly, and in a manner unknown to authors of external programs, modifying one or more essential elements at the protected system in a manner which causes all running programs to fail, unless they are subjected to a compatible modification which enables them to run properly; and (b) modifying each program at the computerized system which is known to be benign in order to comply with said modification of one or more essential elements, thereby to enable it to be executed properly.