Mcafee, Inc.

Intel Corporation

Palanivel Rajan Shanmugavelayutham

Koichi Yamada

Greg William Dalcher

Ned M Smith

Barry E Huntley

Scott Dion Rodgers

Vadim Sukhomlinov

Carl D Woodward

Dmitri Rubakha

James D Beaney, Jr

Jennifer Eligius Mankin

Sravani Konda

Rao S Pitla

Jitendra P Singh

Boaz Tamir

Ioan E Scumpu

Particular embodiments described herein provide for an electronic device that can be configured to monitor code as it executes. The code can include self-modifying code. The system can log an event if the self-modifying code occurred in a GetPC address region.

Detection of shellcode

In an example, there is provided a system and method for execution profiling detection of malicious software objects. An execution profiling (EXP) engine may be provided in conjunction with a binary translation engine (BTE). Both may operate within a trusted execution environment (TEE). Because many malware objects make assumptions about memory usage of host applications, they may cause exceptions when those assumptions prove untrue. The EXP engine may proactively detect such exceptions via the BTE when the BTE performs its translation function. Thus, malicious behavior may be detected before a binary runs on a system, and remedial measures may be provided.

Execution profiling detection of malicious objects

Providing synchronous processing of the designated computing events using hardware-assisted virtualization technology by performing at least the following: detecting a designated computing event using a high priority, low capability routine, creating a copy code in an alternate memory space of a first code located in a first memory space, modifying the copy code to call for analysis of at least a portion of the copy code that corresponds to the first code, switching execution of the first code with the modified copy code using an address translation data structure that translates a guest memory address to a host memory address after a return of the high priority, low capability routine; and analyzing synchronously the at least a portion of the code within the copy code that corresponds to the first code based on the replacement of the first code with the modified copy code.

Synchronous execution of designated computing events using hardware-assisted virtualization

In an embodiment, a processor includes a binary translation (BT) container having code to generate a binary translation of a first code segment and to store the binary translation in a translation cache, a host entity logic to manage the BT container and to identify the first code segment, and protection logic to isolate the BT container from a software stack. In this way, the BT container is configured to be transparent to the software stack. Other embodiments are described and claimed.

Creating an isolated execution environment in a co-designed processor

A method includes generating a chain of trust for a virtual endpoint. The virtual endpoint is associated with a layered architecture that includes layers, which include a physical layer. For each layer, a code image of a process of the layer is measured before the process is loaded to form a node of the chain of trust.

Generating a chain of trust for a virtual endpoint

Growing community of inventors

San Jose, CA, United States of America

Palanivel Rajan Shanmugavelayutham