Iterative method and device for detecting an approximate zone occupied by the computer code of an operating system core in a memory
AssigneeOrange
InventorYacine Hebbal
Life of this patent
Estimating the term…
Abstract
An iterative method and device for detecting an approximate area occupied by computer code of a core of an operating system in a memory, the area including one or more ranges. The method includes: detecting at least one target address in the memory; determining a first area delimited by two of these target addresses; disassembling these areas at least into a part determined during the previous iteration; detecting target addresses pointed to in the disassembled areas; and searching for an additional memory range starting after the second target address obtained on the last iteration and including only computer code.
Claims11
A method for detecting an area occupied by computer code of a core of an operating system in a memory, the area including one or more ranges in the memory, the method being implemented by a detecting device and including:
- an iterative method including:
- a first iteration including:
- detecting at least one target address in the memory;
- and
- determining an area delimited by a first target address and a second target address;
- and
- at least a second iteration including:
- disassembling at least a part of the area determined during a preceding iteration;
- detecting at least one target address pointed to by a computer code instruction contained in the at least one disassembled part of the area;
- and
- determining an area delimited by a first said target address and a second target address detected during the second iteration;
- and
- a stopping condition being verified when no new target address was detected during a last iteration;
- and
- searching for an additional memory range starting just after the second target address obtained on the last iteration and including only the computer code;
- the area occupied by the computer code in the core of the operating system being delimited by the first target address obtained on the last iteration and by a largest address of the additional memory range.
A device for detecting an area occupied by computer code of a core of an operating system in a memory, the area including one or more ranges in the memory, wherein the device comprises:
- a processor;
- and
- a non-transitory computer-readable medium comprising instructions stored thereon which when executed by the processor configure the device to detect the area by:
- implementing an iterative method including:
- a first iteration including:
- detecting at least one target address in the memory;
- and
- determining an area delimited by a first said target address and a second said target address;
- and
- at least a second iteration including:
- disassembling at least a part of the area determined during a preceding iteration;
- detecting at least one target address pointed to by a computer code instruction contained in the at least one disassembled part of the area;
- and
- determining an area delimited by a first said target address and a second target address detected during the second iteration;
- and
- a stopping condition being verified when no new target address was detected during a last iteration;
- and
- searching for an additional memory range starting just after the second target address obtained on the last iteration and including only the computer code;
- the area occupied by the computer code in the core of the operating system being delimited by the first target address obtained on the last iteration and by a largest address of the additional memory range.
A non-transitory computer readable medium having stored thereon instructions which, when executed by a processor, cause the processor to implement a method for detecting an area occupied by computer code of a core of an operating system in a memory, the area including one or more ranges in the memory, the detecting including:
- an iterative method including:
- a first iteration including:
- detecting at least one target address in the memory;
- and
- determining an area delimited by a first target address and a second target address;
- and
- at least a second iteration including:
- disassembling at least a part of the area determined during a preceding iteration;
- detecting at least one target address pointed to by a computer code instruction contained in the at least one disassembled part of the area;
- and
- determining an area delimited by a first target address and a second target address detected during the second iteration;
- and
- a stopping condition being verified when no new target address was detected during a last iteration;
- and
- searching for an additional memory range starting just after the second target address obtained on the last iteration and including only the computer code;
- the area occupied by the computer code in the core of the operating system being delimited by the first target address obtained on the last iteration and by a largest address of the additional memory range.
Dependencies are inferred from the claim text.