Granted Patent B2

US 9,536,089 · App. 12/874,700 · Granted Jan 3, 2017

Abstract

Claims (34)

1. A method for detecting memory modifications, comprising:

allocating a contiguous block of a memory of an electronic device, the electronic device comprising a plurality of processing cores;

loading instructions for detecting memory modifications into the contiguous block of memory, the entirety of the instructions loaded within the contiguous block;

disabling the operation of an operating system of the electronic device by disabling one or more of system interrupts, user interrupts, or scheduler timer interrupts;

disabling all but one of the plurality of processing cores of the electronic device, the remaining processing core executing the instructions, as resident within the contiguous block, for detecting memory modifications;

scanning the memory of the electronic device for modifications performed by malware, after disabling all but one of the plurality of processing cores and disabling one or more of system interrupts, user interrupts, or scheduler timer interrupts;

repairing a memory modification detected during scanning the memory of the electronic device for modifications performed by malware;

enabling the one or more of system interrupts, user interrupts, or scheduler timer interrupts that were disabled, after repairing the memory modification; and

enabling the processing cores that were disabled, after repairing the memory modification.

2. The method of claim 1 , wherein the memory modifications comprise modifications to kernel memory.

3. The method of claim 1 , wherein the memory modifications comprise modifications to application memory.

4. The method of claim 1 , wherein the contiguous block of memory is allocated in non-pageable memory.

5. The method of claim 1 , further comprising:

subsequent to disabling the operating system, enabling the operating system to access a system function, the system function used for repair or diagnosis of memory; and

subsequently disabling the operating system after utilizing the system function.

6. The method of claim 1 , wherein the processing cores of the electronic device are shut down using an operating system service.

7. An article of manufacture, comprising:

a non-transitory computer readable medium; and

computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:

allocate a contiguous block of a memory of an electronic device, the electronic device comprising a plurality of processing cores;

load instructions for detecting memory modifications into the contiguous block of memory, the entirety of the instructions loaded within the contiguous block;

disable the operation of an operating system of the electronic device by disabling one or more of system interrupts, user interrupts, or scheduler timer interrupts;

disable all but one processing cores of the electronic device, the remaining processing core executing the instructions, as resident within the contiguous block, for detecting memory modifications;

scan the memory of an electronic device for modifications performed by malware, after disabling all but one of the plurality of processing cores and disabling one or more of system interrupts, user interrupts, or scheduler timer interrupts;

repair a memory modification detected during the scan of the memory of the electronic device for modifications performed by malware;

enable the one or more of system interrupts, user interrupts, or scheduler timer interrupts that were disabled, after repairing the memory modification; and

enable the processing cores that were disabled, after repairing the memory modification.

8. The article of claim 7 , wherein the memory modifications comprise modifications to kernel memory.

9. The article of claim 7 , wherein the memory modifications comprise modifications to application memory.

10. The article of claim 7 , wherein the contiguous block of memory is allocated in non-pageable memory.

11. The article of claim 7 , wherein the processing is further caused to:

subsequent to disabling the operating system, enable the operating system to access a system function, the system function used for repair or diagnosis of memory; and

subsequently disable the operating system after utilizing the system function.

12. The article of claim 7 , wherein the processing cores of the electronic device are caused to be shut down using an operating system service.

Assignments (10)