Detecting execution of modified executable code
A first storage device or first storage disk including first executable instructions that, when executed, cause a processor to at least: in response to determining a variable associated with a memory page that (1) has been loaded into local memory from a second storage device and (2) has been accessed from the local memory, has a first state, identify the memory page as a modified memory page, the memory page including second executable instructions. The first instructions also cause the processor to, in response to determining the second executable instructions of the modified memory page have been changed since a previous analysis of the modified memory page, perform anti-malware analysis of at least a portion of the modified memory page.
1. A first storage device or first storage disk comprising first executable instructions that, when executed, cause a processor to at least:
in response to determining a variable associated with a memory page that (1) has been loaded into local memory from a second storage device and (2) has been accessed from the local memory, has a first state, identify the memory page as a modified memory page, the memory page including second executable instructions; and
in response to determining the second executable instructions of the modified memory page have been changed since a previous analysis of the modified memory page, perform anti-malware analysis of at least a portion of the modified memory page.
2. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions cause the processor to determine whether the variable associated with the memory page has the first state by examining a page table entry.
3. The first storage device or the first storage disk of claim 1 , wherein the variable is a dirty bit.
4. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions cause the processor to determine if the modified memory page should be further examined by determining whether the second executable instructions of the memory page have been whitelisted or have been generated by a whitelisted module.
5. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions cause the processor to determine whether the second executable instructions of the modified memory page have been changed since a previous analysis of the modified memory page by:
calculating a hash of the modified memory page;
determining whether the hash is in a hash table of previously examined memory pages; and
determining that the second executable instructions of the modified memory page have not been changed since a previous analysis of the modified memory page when the hash is in the hash table.
6. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions cause the processor to queue a trigger object with information about the modified memory page on a trigger queue maintained by a kernel of an operating system.
7. The first storage device or the first storage disk of claim 6 , wherein the first executable instructions cause the processor to perform the anti-malware analysis of the at least the portion of the modified memory page by triggering a client routine from the trigger queue.
8. The first storage device or the first storage disk of claim 1 , wherein the first executable instructions cause the processor to perform a first process at a first priority to determine if the modified memory page should be further examined, and perform a second process at a second priority to determine if the second executable instructions of the modified memory page have been changed since the previous analysis of the modified memory page, the first priority lower than the second priority.
9. A method of improving detection of malware, the method comprising:
in response to determining a variable associated with a memory page that (1) has been loaded into local memory from a second storage device and (2) has been accessed from the local memory, has a first state, identifying the memory page as a modified memory page, the memory page including second executable instructions; and
in response to determining the second executable instructions of the modified memory page have been changed since a previous analysis of the modified memory page, performing anti-malware analysis of at least a portion of the modified memory page.
10. The method of claim 9 , wherein determining whether the variable associated with memory page has the first state includes examining a page table entry.
11. The method of claim 9 , wherein the variable is a dirty bit.
12. The method of claim 9 , further including determining whether the second executable instructions of the memory page have been whitelisted or have been generated by a whitelisted module.
13. The method of claim 9 , wherein the determining of whether the second executable instructions of the modified memory page have been changed since the previous analysis of the modified memory page includes:
calculating a hash of the modified memory page;
determining whether the hash is in a hash table of previously examined memory page; and
determining that the second executable instructions of the modified memory page have not been changed since a previous analysis of the modified memory page when the hash is in the hash table.
14. The method of claim 9 , further including queueing a trigger object with information about the modified memory page on a trigger queue maintained by a kernel of an operating system associated with a performance monitor.
15. The method of claim 14 , wherein the performing of the anti-malware analysis of the at least the portion of the modified memory page includes triggering a client routine from the trigger queue.
16. The method of claim 9 , further including performing a first process at a first priority to determine if the modified memory page should be further examined, and performing a second process at a second priority to determine if the second executable instructions of the modified memory page have been changed since the previous analysis of the modified memory page, the first priority lower than the second priority.
17. A programmable device to detect malware, the programmable device comprising:
memory including first executable instructions; and
a processor to execute the first instructions to:
in response to a variable associated with a memory page that (1) has been loaded into local memory from a second storage device and (2) has been accessed from the local memory, having a first state, identify the memory page as a modified memory page, the memory page including second executable instructions; and
in response to the second executable instructions of the modified memory page having been changed since a previous analysis of the modified memory page, perform anti-malware analysis of at least a portion of the modified memory page.
18. The programmable device of claim 17 , wherein the processor is to determine whether the variable associated with the memory page has the first state by examining a page table entry maintained by the processor.
19. The programmable device of claim 17 , wherein the variable is a dirty bit.
20. The programmable device of claim 17 , wherein the processor is to determine whether the second executable instructions of the memory page have been whitelisted or have been generated by a whitelisted module.
21. The programmable device of claim 17 , wherein the processor is to determine whether the second executable instructions of the modified memory page have been changed since the previous analysis of the modified memory page by:
calculating a hash of the modified memory page;
determining whether the hash is in a hash table of previously examined memory pages; and
determining that the second executable instructions of the modified memory page have not been changed since a previous analysis of the modified memory page when the hash is in the hash table.
22. The programmable device of claim 17 , wherein the processor is to queue a trigger object with information about the modified memory page on a trigger queue maintained by a kernel of an operating system.
23. The programmable device of claim 22 , wherein the processor is to perform anti-malware analysis of the at least the portion of the modified memory page by triggering a client routine from the trigger queue.
24. The programmable device of claim 17 , wherein the processor is to perform a first process at a first priority to determine if the modified memory page should be further examined, and perform a second process at a second priority to determine if the second executable instructions of the modified memory page have been changed since the previous analysis of the modified memory page, the first priority lower than the second priority.