Back to results
US 11,080,401 B2Granted
Memory scanning methods and apparatus
AssigneeIntel Corporation
InventorsMichael LeMay, David M. Durham, Men Long
Life of this patent
Estimating the term…
Abstract
Memory scanning methods and apparatus are disclosed. An example apparatus includes an address identifier to, when an entry of a paging structure has been accessed, determine a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory; and a scanner to: scan a threshold amount of memory beginning at a physical memory address corresponding to the first address; and determine whether the threshold amount of memory includes a pattern indicative of malware.
Claims21
An apparatus comprising:
- an address identifier to, when an entry of a paging structure has been accessed, determine a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory;
- a scan manager to determine a first adjacency corresponding to the first address and a second address and a second adjacency corresponding to the first address and a third address, the second address and the third address corresponding to the page of physical memory, the first adjacency and the second adjacency including a portion of the first address to scan;
- and
- a scanner to:
- scan a first threshold amount of memory beginning at a physical memory address corresponding to the portion of the first address, the first threshold amount of memory corresponding to the first adjacency;
- scan a second threshold amount of memory beginning at the physical memory address corresponding to the portion of the first address, the second threshold amount of memory corresponding to the second adjacency;
- and
- determine whether at least one of first data in the first threshold amount of memory or second data in the second threshold amount of memory includes a pattern indicative of malware, at least one of the address identifier, the scan manager, or the scanner to be implemented by logic circuitry.
5 more elements
At least one tangible computer readable medium comprising instructions that, when executed, cause one or more processors to at least:
- when an entry of a paging structure has been accessed, determine a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory;
- determine a first adjacency corresponding to the first address and a second address and a second adjacency corresponding to the first address and a third address, the second address and the third address corresponding to the page of physical memory, the first adjacency and the second adjacency including a portion of the first address to scan;
- scan a first threshold amount of memory beginning at a physical memory address corresponding to the portion of the first address, the first threshold amount of memory corresponding to the first adjacency;
- scan a second threshold amount of memory beginning at the physical memory address corresponding to the portion of the first address, the second threshold amount of memory corresponding to the second adjacency;
- and
- determine whether at least one of first data in the first threshold amount of memory or second data in the second threshold amount of memory includes a pattern indicative of malware.
3 more elements
A method comprising:
- when an entry of a paging structure has been accessed, determining, by executing an instruction with a processor, a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory;
- determining, by executing an instruction with the processor, a first adjacency corresponding to the first address and a second address and a second adjacency corresponding to the first address and a third address, the second address and the third address corresponding to the page of physical memory, the first adjacency and the second adjacency including a portion of the first address to scan;
- scanning, by executing an instruction with the processor, a first threshold amount of memory beginning at a physical memory address corresponding to the portion of the first address, the first threshold amount of memory corresponding to the first adjacency;
- scanning, by executing an instruction with the processor, a second threshold amount of memory beginning at the physical memory address corresponding to the portion of the first address, the second threshold amount of memory corresponding to the second adjacency;
- and
- determining, by executing an instruction with the processor, whether at least one of first data in the first threshold amount of memory or second data in the second threshold amount of memory includes a pattern indicative of malware.
3 more elements
Dependencies are inferred from the claim text.