Microsoft Technology Licensing, LLC

Jinwook Shin

John J Lambert

Nitin Kumar Goel

Cristian Craioveanu

Joshua Lackey

Elia Florio

Craig Douglas Wilkey, Jr

Craig Douglas Wilkey

A processing platform is described herein for performing a task on a physical system. For example, the task may entail testing untrusted code on the physical system. The processing platform provides the same isolation guarantees as a virtual machine, but without using a virtual machine. A processing framework is also described herein which includes two or more processing platforms, together with a control system for administering the operations performed by the processing platforms.

Framework for running untrusted code

Concepts and technologies are described herein for evaluating shellcode findings. In accordance with the concepts and technologies disclosed herein, shellcode findings can be evaluated to determine if the shellcode findings are legitimate, or if the shellcode findings are false positive shellcode findings. Legitimate shellcode findings can be determined based not simply upon patterns associated with the suspected shellcode itself, but also based upon a pattern of bit-level entropy in the memory around the suspected shellcode. Mathematical models of the memory can be generated and analyzed to determine if the shellcode finding is legitimate.

Evaluating shellcode findings

Growing community of inventors

Newcastle, WA, United States of America

Jinwook Shin