Virsec v. Microsoft: Microsoft patented import-table verification in 2004

What the patents claim

Claim 1 of US 10,331,888 detects memory corruption caused by an address-table attack. It captures a shadow copy of an address table in the control section of memory, checks the table against the shadow copy after a function call executes, checks that the executed call is present in the table, and declares corruption if the contents do not match or the call is missing. It then reports the detected security attack to a user.

Claim 1 of US 8,966,312 runs at least two invariant checks: it captures registers and part of the data segment before a function call, compares them after the call, and declares corruption on a mismatch.

Virsec accuses Windows 10 and 11, Windows Server, Windows 365, Azure Virtual Desktop, Surface devices and Microsoft Defender for Endpoint.

What we found

Microsoft’s US 7,739,516, “Import address table verification” (filed March 2004), loads a software module, works out the correct address of each critical imported function, and verifies the matching entries in the in-memory import address table. It then builds a verified copy of the table and re-verifies the live table against that copy periodically while the module runs, to stop detouring attacks.

Symantec’s US 7,552,479 (filed March 2005) makes a reference copy of a process’s import address table at start-up and hooks calls to critical imported functions. When such a call arrives, it checks the current table entries against the reference copy, treats a mismatch as an evasion attempt by shellcode, and generates a notification and takes protective action.

Neither reference appears in the 166 citations on the ’888 or the 231 across its family, and neither patent has faced a PTAB petition.

Why it matters to the defendant

The closest prior art is Microsoft’s own patent, so the inventors and the 2004 Windows engineering behind it are within the defendant’s reach. Between them, the two references cover the shadow copy, the comparison, declaring corruption and reporting the attack. The open points are timing and the second check. Claim 1 checks the table after the function call executes, whereas Microsoft re-verifies periodically and Symantec checks when the call arrives. Claim 1 also checks that the executed call is present in the table. The family expires in about February 2027, so the dispute is over past use.

Limits of this analysis

• The address-table claims may be entitled only to the 2007 continuation-in-part date. We used the earlier 2006 provisional date, and both references predate it.
• Our index holds the full claims and roughly the first 10,000 characters of each description. Passages were checked in that text, and a full claim chart against the complete documents is the next step.
• Rootkit and anti-tamper tools from 2004 to 2006 that scanned for import-table hooks are likely further non-patent evidence and are outside this search.

“Not cited” means the reference does not appear in the examiner or applicant citations of the patent or its family in our index. This article is research, not legal advice, and makes no finding that any claim is invalid.