Method of defending a computer from malware
AssigneeCheck Point Software Technologies Ltd.
InventorsTomer TELLER, Assaf SEGAL
Life of this patent
Estimating the term…
Abstract
To defend a computer against malware, first executable code, of the computer, that includes a signature that identifies an address, in the computer's memory, of a respective data structure that is potentially vulnerable to tampering, is identified. The first executable code is copied to provide second executable code that emulates the first executable code using its own respective data structure. The first executable code is modified to jump to the second executable code before accessing the data structure, and also so that the signature identifies the address of a guard page.
Claims17
A method of defending a computer from malware, comprising:
- (a) identifying first executable code, of the computer, that includes a signature that identifies an address, in a memory of the computer, of a respective data structure that is potentially vulnerable to tampering by the malware;
- (b) providing, to the computer, second executable code that emulates said first executable code;
- and
- (c) modifying said first executable code so that an execution of said first executable code jumps to said second executable code before accessing said respective data structure of said first executable code.
A computer comprising:
- (a) a first memory;
- (b) a second memory;
- (c) in said first memory:
- (i) first executable code that includes:
- (A) program code for accessing a data structure in said memory that is potentially vulnerable to tampering by malware, and
- (B) a signature that is interpreted by said malware as identifying an address of said data structure, and
- (ii) second executable code that includes:
- (A) program code for providing third executable code that emulates said first executable code, and
- (B) program code for modifying a first copy of said first executable code in said second memory by inserting into said first copy an instruction to jump to said third executable code before said program code for accessing said data structure is executed;
- and
- (d) a processor for executing said executable codes in said second memory.
A computer-readable storage medium having non-transient computer-readable code embodied on the computer-readable storage medium, the computer-readable code for defending from malware a computer that includes a memory wherein is stored first executable code that includes:
- (a) program code for accessing a data structure in the memory that is potentially vulnerable to tampering by the malware, and
- (b) a signature that is interpreted by the malware as identifying an address of said data structure,
- the computer-readable code comprising:
- (a) program code for providing second executable code that emulates said first executable code;
- and
- (b) program code for inserting into the first executable code an instruction to jump to said second executable code before said program code for accessing the data structure is executed.
Dependencies are inferred from the claim text.