Microsoft patents method to erase old code after software patches
Microsoft describes a technique to improve software security by removing vulnerable code from memory after a patch is applied. The system checks if any active processes are still using the old version of the code before overwriting it with unusable instructions.
In the filing’s own words
Disclosed are techniques for disabling security exploits. Some live code patches redirect execution from a vulnerable version of a function to a secure version of the function. However, the vulnerable version of the function may remain in memory, creating an opportunity for exploitation. Disclosed are techniques for determining when the vulnerable version of the function is no longer in use, and when this determination is made, rendering at least a vulnerable portion of the vulnerable version of the function inoperable. Reference counting, call stack inspection, and process lifecycle tracking may be used to determine when the vulnerable version of the function is no longer in use. Some implementations may employ compiler-assisted instrumentation, run-time generated instrumentation, or hardware support. The vulnerable version of the function may be rendered inoperable by overwriting it with illegal instructions, marking a page of memory that contains the vulnerable version of the function non-executing, etc.
What exactly they claim (claim 1)
1. A method comprising: overwriting a portion of a function with instructions that redirect execution to a revised version of the function, wherein the function is included in an executable module; identifying a plurality of threads executing within a process that has loaded the executable module; pausing execution of the plurality of threads; analyzing a plurality of call stacks of the plurality of threads to determine that the function is not being executed by the plurality of threads; analyzing the plurality of call stacks of the plurality of threads to determine that the plurality of threads are not scheduled to return to and resume execution of the function; and rendering a function body of the function inoperable.
Facts
- Company
- Microsoft (MICROSOFT TECHNOLOGY LICENSING, LLC)
- Official title
- INVALIDATING MEMORY CONTENTS AFTER PATCHING SOFTWARE
- Publication number
- US20260310490A1
- Application number
- 19251757
- Filed
- Jun 26, 2025
- Published
- Oct 8, 2026
- Inventors
- 2
- Claims
- 20
Classified under
G06F 9/485 Physics & computingG06F 9/4881 Physics & computingMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents one-way data flow to block network attacks Sep 10, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.