Extensible activation exploit scanner

A system for an extensible activation exploit scanner installed on a processing device, the system comprising:

• at least one detection module, each of the at least one detection module including a respective signature for detecting a respective known activation exploit or a respective known class of activation exploit, the respective known activation exploit or the respective known class of activation exploit being for deceiving authentication components, such that a counterfeit copy of software is authenticated as a genuine copy of the software, the respective signature being an algorithm that is specific to detecting the respective known activation exploit or the respective known class of activation exploit;
• at least one response module, each of the at least one response module for performing a corresponding action responsive to detecting the respective known activation exploit or the respective known class of activation exploit;
• an exploit data file including at least one entry, each of the at least one entry including an identifier corresponding to a respective known activation exploit or a respective known class of activation exploit, location information of one of the at least one detection module, and location information of one of the at least one response module;
• and
• a scanner for scanning for a presence of the respective known activation exploit or the respective known class of activation exploit by calling a detection module of the at least one detection module identified by an entry of the exploit file as being for detecting the respective known activation exploit or the respective known class of activation exploit, and the scanner further being for responding to the presence of the respective known activation exploit or the respective known class of activation exploit by calling a response module of the at least one response module identified by the entry of the exploit file.

A machine-readable storage device having instructions recorded thereon for a processing device to perform a method comprising:

• reading, by the processing device, an entry of an exploit data file, the entry including an identifier corresponding to a known activation exploit, location information of a detection module, and location information of a response module, the known activation exploit being for deceiving authentication components, such that a counterfeit copy of software is authenticated as a genuine copy of the software;
• using, by the processing device, the location information of the detection module to execute the detection module to detect whether the known activation exploit is present;
• and
• using, by the processing device, the location information of the response module to execute the response module to perform one or more actions in response to the detection module detecting that the known activation exploit is present.