Atomic detection and repair of kernel memory
AssigneeMcAfee, Inc.
InventorAhmed Said Sallam
Life of this patent
Estimating the term…
Abstract
A method for detecting memory modifications includes allocating a contiguous block of a memory of an electronic device, and loading instructions for detecting memory modifications into the contiguous block of memory. The electronic device includes a plurality of processing entities. The method also includes disabling all but one of a plurality of processing entities of the electronic device, scanning the memory of the electronic device for modifications performed by malware, and, if a memory modification is detected, repairing the memory modification. The method also includes enabling the processing entities that were disabled. The remaining processing entity executes the instructions for detecting memory modifications.
Claims20
A method for detecting memory modifications, comprising:
- allocating a contiguous block of a memory of an electronic device, the electronic device comprising a plurality of processing entities;
- loading instructions for detecting memory modifications into the contiguous block of memory;
- disabling all but one of the plurality of processing entities of the electronic device, the remaining processing entity executing the instructions for detecting memory modifications;
- scanning the memory of the electronic device for modifications performed by malware;
- if a memory modification is detected, repairing the memory modification;
- and
- enabling the processing entities that were disabled.
An article of manufacture, comprising:
- a computer readable medium;
- and
- computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
- allocate a contiguous block of a memory of an electronic device, the electronic device comprising a plurality of processing entities;
- load instructions for detecting memory modifications into the contiguous block of memory;
- disable all but one processing entity of the electronic device, the remaining processing entity executing the instructions for detecting memory modifications;
- scan the memory of an electronic device for modifications performed by malware;
- if a memory modification is detected, repair the memory modification;
- and
- enable the processing entities that were disabled.
Dependencies are inferred from the claim text.