Orange

Yacine Hebbal

Sylvie Laniepce

An iterative method and device for detecting an approximate area occupied by computer code of a core of an operating system in a memory, the area including one or more ranges. The method includes: detecting at least one target address in the memory; determining a first area delimited by two of these target addresses; disassembling these areas at least into a part determined during the previous iteration; detecting target addresses pointed to in the disassembled areas; and searching for an additional memory range starting after the second target address obtained on the last iteration and including only computer code.

Iterative method and device for detecting an approximate zone occupied by the computer code of an operating system core in a memory

A method for identifying a function of an operating system kernel of a virtual machine. The method includes: identifying an initial instruction included in the code of the operating system kernel of the virtual machine, and locating at least one following block of instructions belonging to a function of the operating system kernel of the virtual machine, the following block being situated in a memory area following the initial instruction; locating at least one preceding block of instructions belonging to a function of the operating system kernel, the proceeding block situated in a memory area preceding the initial instruction; identifying a first block and a last block of instructions of the function of the operating system kernel from among the at least one following and preceding blocks, and recording start and end function addresses in association with the function of the operating system kernel.

Growing community of inventors

Caen, France

Yacine Hebbal