Hypervisor-Based Interception of Memory Accesses

A non-transitory computer-readable medium having stored thereon executable instructions which, when executed by a computing device, cause the computing device to perform operations comprising:

• identifying memory locations of a subset of memory locations in memory of the computing device to be intercepted;
• determining pages of the memory which include the identified memory locations;
• setting privilege attributes of the pages to prevent specific types of operations from affecting the memory locations;
• noting an operation affecting another memory location associated with one of the pages which differs from the identified memory location associated with that page;
• and
• temporarily resetting the privilege attribute of the one of the pages to allow the operation.

A computer-implemented method comprising:

• identifying memory locations of a subset of memory locations in memory of the computing device to be intercepted;
• determining pages of the memory which include the identified memory locations;
• setting privilege attributes of the pages to prevent specific types of operations from affecting the memory locations;
• noting an operation affecting one of the identified memory locations;
• in response to noting the operation, either:
• temporarily resetting the privilege attribute of the page including the one of the identified memory locations to allow the operation, or
• returning a false indication of success for the operation.