Detecting execution of modified executable code
A technique for detecting malware uses hardware capabilities of the processing element of a programmable device to detect modification of executable code during execution. By monitoring a dirty bit in page tables, pages that have been modified can be detected, allowing analysis of those pages during execution. An indication may then be passed to an anti-malware software to analyze the executable further.
1. A first storage device or first storage disk comprising first executable instructions that, when executed, cause a processor to at least:
in response to an interrupt from a performance monitoring unit after a memory page including second executable instructions has been loaded into local memory from a second storage device and has been accessed from the local memory, determine whether the second executable instructions of the memory page have been modified thereby changing the memory page into a modified memory page; and
in response to the second executable instructions of the modified memory page having been modified, trigger a client routine to perform anti-malware analysis of at least a portion of the modified memory page before the modified memory page is written back to the second storage device.
2. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions, when executed, cause the processor to determine whether the second executable instructions of the memory page have been modified by:
examining a page table entry maintained by the processor; and
determining that the second executable instructions of the memory page have been modified based on the page table entry.
3. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions, when executed, cause the processor to:
determine whether the second executable instructions of the memory page have been whitelisted or have been generated by a whitelisted module; and
refrain from triggering the client routine to perform the anti-malware analysis of the memory page when the second executable instructions of the memory page have been whitelisted or have been generated by the whitelisted module.
4. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions, when executed, cause the processor to:
determine whether the second executable instructions of the modified memory page have changed since a previous analysis of the modified memory page; and
refrain from triggering the client routine to perform the anti-malware analysis of the modified memory page when the second executable instructions of the modified memory page have not changed since the previous analysis of the memory page.
5. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions, when executed, cause the processor to determine whether the second executable instructions of the memory page have been modified by:
calculating a hash of the memory page;
determining whether the hash is in a hash table of previously examined memory pages; and
determining that the second executable instructions of the memory page have not been modified when the hash is in the hash table.
6. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions cause the processor to execute a first routine at a first priority to determine whether the second executable instructions of the memory page have been modified and to execute a second routine at a second priority lower than the first priority.
7. The first storage device or the first storage disk of claim 6 , wherein the first executable instructions, when executed, cause the processor to queue a trigger object on a trigger queue maintained by a kernel of an operating system associated with the processor.
8. The first storage device or the first storage disk of claim 1 , wherein the second executable instructions of the memory page include a call or jump instruction.
9. A method of improving detection of malware, the method comprising:
in response to an interrupt from a performance monitoring unit after a memory page including executable instructions has been loaded into local memory from a storage device and has been accessed from the local memory, determining whether the executable instructions of the memory page have been modified thereby changing the memory page into a modified memory page; and
in response to the executable instructions of the modified memory page having been modified, performing anti-malware analysis of at least a portion of the modified memory page before the modified memory page is written back to the storage device.
10. The method of claim 9 , further including:
examining a hardware-maintained page table entry; and
determining the executable instructions of the memory page have been modified based on the page table entry.
11. The method of claim 9 , further including:
determining whether the executable instructions associated with the memory page have been blacklisted; and
ignoring the memory page when the executable instructions have not been blacklisted.
12. The method of claim 9 , further including:
determining whether the executable instructions of the modified memory page have changed since a previous examination of the modified memory page; and
ignoring the modified memory page when the executable instructions of the modified memory page have not changed since the previous examination.
13. The method of claim 9 , further including:
generating a hash of the memory page;
determining whether the hash is in a hash table of previously examined memory pages; and
determining that the executable instructions of the memory page have not been modified when the hash is in the hash table.
14. The method of claim 9 , further including executing a first routine at a first priority to determine whether the executable instructions of the memory page have been modified, and executing a second routine at a second priority to queue a trigger object to trigger the anti-malware analysis, the second priority lower than the first priority.
15. The method of claim 14 , further including queuing the trigger object on a trigger queue maintained by a kernel of an operating system associated with the performance monitoring unit.
16. The method of claim 9 , wherein the executable instructions of the memory page include a call or jump instruction.
17. The method of claim 16 , further including generating the interrupt only upon a threshold plurality of occurrences of the call or jump instruction.
18. A programmable device to detect malware, the programmable device comprising:
a processor; and
a memory including first executable instructions that, when executed, cause the processor to:
in response to an interrupt from a performance monitoring unit after a memory page including second executable instructions has been loaded into local memory from a storage device and has been accessed from the memory, determine whether the second executable instructions of the memory page have been modified thereby changing the memory page into a modified memory page; and
in response to the second executable instructions of the modified memory page having been modified, trigger a client routine to perform anti-malware analysis of at least a portion of the modified memory page before the modified memory page is written back to the storage device.
19. The programmable device of claim 18 , wherein the processor is to determine whether the second executable instructions of the memory page have been modified by examining a page table entry maintained by the processor.
20. The programmable device of claim 18 , wherein the processor is to:
determine whether the second executable instructions have been whitelisted or have been generated by a whitelisted module; and
ignore the modified memory page when the second executable instructions have been whitelisted.
21. The programmable device of claim 18 , wherein the processor is to:
determine whether the second executable instructions of the modified memory page have changed since a previous analysis of the modified memory page; and
ignore the modified memory page when the second executable instructions of the modified memory page have not changed since the previous analysis of the modified memory page.
22. The programmable device of claim 21 , wherein the processor is to determine whether the second executable instructions of the modified memory page have changed by:
calculating a hash of the modified memory page;
determining whether the hash is in a hash table of previously examined memory pages; and
determining that the second executable instructions of the modified memory page have not changed when the hash is in the hash table.
23. The programmable device of claim 18 , wherein the processor is to execute a first routine at a first priority to determine whether the second executable instructions of the memory page have been modified, and to execute a second routine at a second priority to queue a trigger object to trigger the client routine, the second priority lower than the first priority.
24. The programmable device of claim 23 , wherein the processor is to queue the trigger object on a trigger queue maintained by a kernel of an operating system associated with the processor.
25. The programmable device of claim 18 , wherein the second executable instructions include call or jump instructions.