Buffer Overflow class type

The Buffer Overflow class type prevents buffer overflow exploits for applications in the application protection list.

Note
Exploit Prevention is not supported in the ARM architecture.

Section	Value	Notes
user_name
Executable
dependencies	428	Specifies Signature 428, Generic Buffer Overflow, a generic buffer overflow rule. (Optional) We recommend including section "dependencies 428" to avoid triggering the generic signature.
caller module	Path to a module (for example, a DLL) loaded by an executable that calls and causes a buffer overflow
directives	bo:stack	Examines the memory location that is executing and detects if it is running from writable memory that is part of the current thread's stack.
	bo:heap	Examines the memory location that is executing and detects if it is running from writable memory that is part of a heap.
	bo:writeable_memory	Examines the memory location that is executing and detects if it is running from writable memory that is not part of the current thread's stack or a heap.
	bo:invalid_call	Checks that an API is called from a proper call instruction.
	bo:target_bytes	A hexadecimal string representing 32 bytes of instructions that can be used to create a targeted exception for a false positive without disabling buffer overflow for the entire process.
	bo:call_not_found	Checks that the code sequence before the return address isn't a call.
	bo:call_return_unreadable	Checks that the return address isn't readable memory.
	bo:call_different_target_address	Checks that the call target doesn't match the hooked target.
	bo:call_return_to_api	Checks that the return address is an API entry point.