Intel Corporation

Mcafee, Inc.

Institute for the Development of Emerging Architectures, L.l.c.

Microsoft Technology Licensing, LLC

Hewlett-packard Company

Institute for the Development of Emerging Architecture L.l.c.

Koichi Yamada

Gary N Hammond

Paul Caprioli

Jiwei Lu

Palanivelrajan Rajan Shanmugavelayutham

Jonathan Kent Ross

William R Bryg

Stephen G Burger

Joseph Nuzman

Suresh Srinivas

Gilbert A Neiger

Alex Nayshtut

Suresh K Marisetty

Jeffrey J Cook

Jason M Agron

Robert Valentine

Mark Jay Charney

Jesus Corbal

Rajesh M Sankaran

Edward Thomas Grochowski

Ali-Reza Adl-Tabatabai

Gad Shlomo Sheaffer

Eriko Nurvitadhi

Arun Upadhyaya Kishan

Jan Stephen Gray

Thomas D Fletcher

Landy Wang

Deborah T Marr

Martin Taillefer

Stephen R Van Doren

Asit K Mallick

Dennis Ryan Bradford

Lokpraveen B Mosur

Narayan Ranganathan

David S Callahan

Kent D Glossop

Jonathan D Pearce

Niall D McDonnell

Richard J Greco

Ganesh Venkatesh

Asit K Mishra

Dwight P Manley

Arvind Krishnaswamy

David B Sheffield

Tracy Garrett Drysdale

Nicholas P Carter

Ajay Harikumar

Vadim Sukhomlinov

Jose Andy Vargas

Abhay Kanhere

Ravi L Sahita

Mohan J Kumar

Barry E Huntley

Youfeng Wu

Igor G Muttik

Scott Dion Rodgers

David J Sager

Ron Gabor

Rajiv Gupta

Nhon Toai Quach

Shlomo Raikin

Carl D Woodward

Kushagra V Vaid

Tin-Fook Ngai

Ruchira Sasanka

Sebastian Winkel

Vadim Bassin

Yuriy Bulygin

Dmitri Rubakha

Jayaram Bobba

Ho-Seop Kim

James D Beaney, Jr

Keqiang Wu

Vedvyas Shanbhogue

Eliezer Weissmann

Richard A Uhlig

Murugasamy K Nachimuthu

Alon Naveh

Ronny Ronen

Boris Ginzburg

Wei Ey Li

Ioannis T Schoinas

Gautham N Chinya

Matthew C Merten

James B Crossland

Shivnandan D Kaushik

Michael Mishaeli

Richard A Hankins

Perry H Wang

Achmed Rumi Zahir

Andrew J Fish

Konstantin Levit-Gurevich

Rajesh Sankaran Madukkarumukumana

Jamison D Collins

Jerome C Huck

Amy L Santoni

Baskaran Ganesan

Venkat R Gokulrangan

Bo A Zhang

Esfir Natanzon

Embodiments of systems, methods, and apparatuses for heterogeneous computing are described. In some embodiments, a hardware heterogeneous scheduler dispatches instructions for execution on one or more plurality of heterogeneous processing elements, the instructions corresponding to a code fragment to be processed by the one or more of the plurality of heterogeneous processing elements, wherein the instructions are native instructions to at least one of the one or more of the plurality of heterogeneous processing elements.

Systems, methods, and apparatuses for heterogeneous computing

A disclosed example apparatus includes memory; and processor circuitry to: identify a lock-protected section of instructions in the memory; replace lock/unlock instructions with transactional lock acquire and transactional lock release instructions to form a transactional process; and execute the transactional process in a speculative execution.

Memory management method and apparatus

A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection

The present disclosure is directed to a system for on-demand binary translation state map generation. Instead of interpreting the native code to be executed, binary translation circuitry (BT circuitry) may execute a binary translation (BT) in place of the native code. When a stop occurs (e.g., due to an interrupt, a modification of the native code, etc.), the BT circuitry may generate a binary translation state map (BT state map) that allows the location of the stop to be mapped back to the native code. Generation of the BT state map may involve determining a location and offset for the stop, performing region formation based on the location, loading instructions from the region (e.g., while accounting for the need to emulate instructions), forming the BT state map based at least on the size of the loaded instructions, and then mapping the stop back to the native code utilizing the offset.

On-demand binary translation state map generation

The disclosed embodiments generally relate to detecting malware through detection of micro-architectural changes (morphing events) when executing a code at a hardware level (e.g., CPU). An exemplary embodiment relates to a computer system having: a memory circuitry comprising an executable code; a central processing unit (CPU) in communication with the memory circuitry and configured to execute the code; a performance monitoring unit (PMU) associated with the CPU, the PMU configured to detect and count one or more morphing events associated with execution of the code and to determine if the counted number of morphine events exceed a threshold value; and a co-processor configured to initiate a memory scan of the memory circuitry to identify a malware in the code.

Methods, systems and apparatus to detect polymorphic malware

Systems, methods, and apparatuses for last branch record support are described. In an embodiment, a hardware processor core comprises a hardware execution unit to execute a branch instruction, at least two last branch record (LBR) registers to store a source and destination information of a branch taken during program execution, wherein an entry in a LBR register is to include an encoding of the branch, a write bit array to indicate which LBR register is architecturally correct, an architectural bit array to indicate when an LBR register has been written, and a plurality of top of stack pointers to indicate which LBR register in a LBR register stack is to be written.

Systems, methods, and apparatuses for last branch record support compatible with binary translation and speculative execution using an architectural bit array and a write bit array

After a heuristic event counter in a processor has triggered a performance monitoring interrupt (PMI) when the processor was executing a target program in user mode, and after the processor has switched to kernel mode in response to the PMI, a heuristic event handler automatically performs preliminary analysis in kernel mode, without switching back to user mode, to determine whether heavyweight code analysis is warranted. The preliminary analysis comprises (a) obtaining an instruction pointer (IP) for the target program from a last branch record (LBR) buffer in the processor, (b) using transaction hardware in the processor to determine whether the IP from LBR buffer points to a readable page in memory, and (c) determining that heavyweight code analysis is not warranted in response to a determination that the page pointed to by the IP from LBR buffer is not readable. Other embodiments are described and claimed.

Systems, methods, and apparatus for detecting control flow attacks

Particular embodiments described herein provide for an electronic device that can be configured to monitor code as it executes. The code can include self-modifying code. The system can log an event if the self-modifying code occurred in a GetPC address region.

Detection of shellcode

Technologies for binary translation include a computing device that allocates a translation cache shared by all threads associated with a corresponding execution domain. The computing device assigns a thread to an execution domain, translates original binary code of the thread to generate translated binary code, and installs the translated binary code into the corresponding translation cache for execution. The computing device may allocate a global region cache, generate region metadata associated with the original binary code of a thread, and store the region metadata in the global region cache. The original binary code may be translated using the region metadata. The computing device may allocate a global prototype cache, translate the original binary code of a thread to generate prototype code, and install the prototype code in the global prototype cache. The prototype code may be a non-executable version of the translated binary code. Other embodiments are described and claimed.

Technologies for scalable translation caching for binary translation systems

Systems, apparatuses, and methods for a hardware and software system to automatically decompose a program into multiple parallel threads are described. In some embodiments, the systems and apparatuses execute a method of original code decomposition and/or generated thread execution.

Systems, apparatuses, and methods for a hardware and software system to automatically decompose a program to multiple parallel threads

A micro-architecture may provide a hardware and software co-designed dynamic binary translation. The micro-architecture may invoke a method to perform a dynamic binary translation. The method may comprise executing original software code compiled targeting a first instruction set, using processor hardware to detect a hot spot in the software code and passing control to a binary translation translator, determining a hot spot region for translation, generating the translated code using a second instruction set, placing the translated code in a translation cache, executing the translated code from the translated cache, and transitioning back to the original software code after the translated code finishes execution.

Instruction and logic to perform dynamic binary translation

Methods, apparatus, and system to identify a memory contention with respect to a process, re-write the process to form a transactional process, and execute the transactional process in a speculative execution.

Growing community of inventors

Los Gatos, CA, United States of America

Koichi Yamada