Memory scanning methods and apparatus
AssigneeIntel Corporation
InventorsMichael LeMay, David M. Durham, Men Long
Life of this patent
Estimating the term…
Abstract
Memory scanning methods and apparatus are disclosed. An example apparatus includes an address identifier to, when an entry of a paging structure has been accessed, determine a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory; and a scanner to: scan a threshold amount of memory beginning at a physical memory address corresponding to the first address; and determine whether the threshold amount of memory includes a pattern indicative of malware.
Claims21
An apparatus comprising:
- an address identifier to, when an entry of a paging structure has been accessed, determine a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory;
- and
- a scanner to:
- scan a threshold amount of memory beginning at a physical memory address corresponding to the first address;
- and
- determine whether the threshold amount of memory includes a pattern indicative of malware.
At least one tangible computer readable medium comprising instructions that, when executed, cause one or more processors to at least:
- when an entry of a paging structure has been accessed, determine a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory;
- scan a threshold amount of memory beginning at a physical memory address corresponding to the first address;
- and
- determine whether the threshold amount of memory includes a pattern indicative of malware.
A method comprising:
- when an entry of a paging structure has been accessed, determining, by executing an instruction with a processor, a first address corresponding to a page of physical memory when the entry of the paging structure maps to the page of the physical memory;
- scanning, by executing an instruction with the processor, a threshold amount of memory beginning at a physical memory address corresponding to the first address;
- and
- determining, by executing an instruction with the processor, whether the threshold amount of memory includes a pattern indicative of malware.
Dependencies are inferred from the claim text.