Technologies for hardware assisted native malware detection

One or more non-transitory machine-readable storage media comprising a plurality of instructions stored thereon that in response to being executed, cause a computing device to:

• provide filter criteria to hook logic of the computing device;
• provide an address of a callback function to the hook logic to be executed in response to a determination that a monitored branch instruction of an application satisfies the filter criteria;
• monitor, with the hook logic, execution of branch instructions of the application;
• compare, with the hook logic, the monitored branch instructions to the filter criteria;
• determine, with the hook logic, whether one of the monitored branch instructions satisfies the filter criteria;
• execute the callback function in response to a determination that one of the monitored branch instructions satisfies the filter criteria, to analyze the monitored branch instruction to determine whether the monitored branch instruction is indicative of malware;
• determine, in response to a determination that the monitored branch instruction is indicative of malware, differences between an unmodified system image and a shadow area that was written to by the application;
• and
• write, to malware signature data usable by the computing device to determine whether activity of the application is indicative of malware, data indicative of the determined differences between the unmodified system image and the shadow area.

A method for performing hardware assisted malware detection on an application, the method comprising:

• providing, by a computing device, filter criteria to hook logic of the computing device;
• providing, by the computing device, an address of a callback function to the hook logic to be executed in response to a determination that a monitored branch instruction of the application satisfies the filter criteria;
• monitoring, by the hook logic of the computing device, execution of branch instructions of the application;
• comparing, by the hook logic of the computing device, the monitored branch instructions to the filter criteria;
• determining, by the hook logic of the computing device, whether one of the monitored branch instructions satisfies the filter criteria;
• executing, by the computing device, the callback function in response to a determination that one of the monitored branch instructions satisfies the filter criteria, to analyze the monitored branch instruction to determine whether the monitored branch instruction is indicative of malware;
• determining, by the computing device and in response to a determination that the monitored branch instruction is indicative of malware, differences between an unmodified system image and a shadow area that was written to by the application;
• and
• writing, by the computing device and to malware signature data usable by the computing device to determine whether activity of the application is indicative of malware, data indicative of the determined differences between the unmodified system image and the shadow area.