Abstract: Detection of an exploit including shellcode is disclosed. Memory blocks are monitored during dynamic analysis of a sample to identify a memory block including suspicious shellcode. The memory block is dumped in memory to identify a candidate shellcode entry point associated with the suspicious shellcode. The suspicious shellcode is executed based on the candidate shellcode entry point to determine whether the suspicious shellcode is malicious. A verdict is generated regarding the sample based on results of executing the suspicious shellcode.

Abstract: A computer is protected from argument switch attacks by intercepting a function call to terminate a process. The function call and a handle used as an argument in the function call are forwarded by an antivirus system service descriptor table to an antivirus. The antivirus is configured to evaluate the function call to determine whether or not the function call is terminating an antivirus process. A consistent handle table includes a listing of handles of processes employed as arguments in function calls that terminate processes and are approved by the antivirus. Instructions that close a handle are detected by the antivirus, which compares the handle to those in the consistent handle table. The antivirus blocks those instructions that close a handle that is included in the consistent handle table.