Memory scanning methods and apparatus

An apparatus, comprising:

• a walker to traverse a paging structure of an address translation system;
• a bit analyzer to determine whether a bit associated with an entry of the paging structure is indicative of the entry being recently accessed;
• an address identifier to, when the bit analyzer determines that the bit associated with the entry of the paging structure is indicative of the entry being recently accessed, associated with the entry;
• an outputter to provide the determined address to a memory scanner to scan a memory location associated with the address for malware, wherein at least one of the walker, the bit analyzer, the address identifier, or the outputter is implemented via a logic circuit;
• a protection assignor to:
• determine a first protection domain under which a first one of the walker, the bit analyzer, the address identifier, the outputter, or the memory scanner is to operate;
• and
• determine a second protection domain under which a second one of the walker, the bit analyzer, the address identifier, the outputter, or the memory scanner is to operate;
• and
• a workload offloader to:
• select a first processing component to implement the first one of the walker, the bit analyzer, the outputter, or the memory scanner;
• and
• select a second processing component different than the first processing component to implement the second one of the walker, the bit analyzer, the outputter or the memory scanner.

A method, comprising:

• traversing, by executing an instruction with a processor, a paging structure of an address translation system;
• determining, by executing an instruction with a processor, whether a bit associated with an entry of the paging structure is indicative of the entry being recently accessed;
• and
• when the bit associated with the entry of the paging structure is indicative of the entry being recently accessed:
• determining, by executing an instruction with the processor, whether the entry of the paging structure maps a page of physical memory and, if the entry maps a page of physical memory instead of mapping to another paging structure, determining an address corresponding to the physical memory;
• and
• providing, by executing an instruction with a processor, the determined address to a memory scanner to scan the address for malware.

At least one tangible computer readable medium comprising instructions that, when executed, cause a machine to at least:

• traverse a paging structure of an address translation system;
• determine whether a bit associated with an entry of the paging structure is indicative of the entry being recently accessed;
• and
• when the bit associated with the entry of the paging structure is indicative of the entry being recently accessed:
• determine whether the entry of the paging structure maps a page of physical memory and, when the entry maps a page of physical memory instead of mapping to another paging structure, determine an address corresponding to the physical memory;
• and
• provide the determined address to a memory scanner to scan the address for malware.

At least one tangible computer readable medium comprising instructions that, when executed, cause a machine to at least:

• traverse a paging structure of an address translation system;
• determine whether a bit associated with an entry of the paging structure is indicative of the entry being recently accessed;
• and
• when the bit associated with the entry of the paging structure is indicative of the entry being recently accessed:
• determine an address associated with the entry;
• provide the determined address to a memory scanner to scan the address;
• determine a first protection domain for a first one of the traversing of the paging structure, the determining whether the bit associated with the entry of the paging structure is indicative of the entry being recently accessed, the determining of the address associated with the entry, the providing of the determined address to the memory scanner, or a scanning of memory by the memory scanner;
• determine a second protection domain different from the first protection domain for a second one of the traversing of the paging structure, the determining whether the bit associated with the entry of the paging structure is indicative of the entry being recently accessed, the determining of the address associated with the entry, the providing of the determined address to the memory scanner, or the scanning of memory by the memory scanner;
• select a first processing component to implement the first one of the traversing of the paging structure, the determining whether the bit associated with the entry of the paging structure is indicative of the entry being recently accessed, the determining of the address associated with the entry, the providing of the determined address to the memory scanner, or a scanning of memory by the memory scanner;
• and
• select a second processing component different than the first processing component to implement the second one of the traversing of the paging structure, the determining whether the bit associated with the entry of the paging structure is indicative of the entry being recently accessed, the determining of the address associated with the entry, the providing of the determined address to the memory scanner, or a scanning of memory by the memory scanner.