Non-invasive program execution protection

A system, comprising:

• a memory;
• and
• a processor operatively coupled to the memory, the processor being configured to perform the operations of:
• executing a computer program on the processor;
• while the computer program is running, detecting whether any of a plurality of transition instructions of the computer program is executed, the detecting being performed by using resources that are external to the computer program;
• in response to detecting that a given one of the plurality of transition instructions of the computer program is executed, retrieving a current value of a memory location associated with the computer program;
• detecting whether the current value of the memory location associated with the computer program matches one or more expected values for the memory location associated with the computer program that corresponds to the given transition instructions, the one or more expected values for the memory location associated with the computer program being identified based on a data record the data record mapping each of the plurality of transition instructions of the computer program to one or more respective values, which the memory location is expected to have when the transition instruction of the computer program is executed;
• and
• performing a countermeasure action when the current value of the memory location associated with the computer program does not match the one or more expected values for the memory location associated with the computer program.

A non-transitory computer-readable medium storing one or more processor-executable instructions, which when executed by a processor, cause the processor to perform the operations of:

• executing a computer program on the processor;
• while the computer program is running, detecting whether any of a plurality of transition instructions of the computer program is executed, the detecting being performed by using resources that are external to the computer program;
• in response to detecting that a given one of the plurality of transition instructions of the computer program is executed, retrieving a current value of a memory location associated with the computer program;
• detecting whether the current value of the memory location associated with the computer program matches one or more expected values for the memory location associated with the computer program that correspond to the given transition instruction, the one or more expected values for the memory location associated with the computer program being identified based on a data record, the data record mapping each of the plurality of transition instructions of the computer program to one or more respective values, which the memory location is expected to have when the transition instruction of the computer program is executed;
• and
• performing a countermeasure action when the current value of the memory location associated with the computer program does not match the one or more expected values for the memory location associated with the computer program.