METHOD AND APPARATUS FOR TRANSPARENTLY INSTRUMENTING AN APPLICATION PROGRAM

• US 20120255015A1
• Filed: 03/30/2011
• Published: 10/04/2012
• Est. Priority Date: 03/30/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sahita, Ravi L., Durham, David M., Dewan, Prashant, Castelino, Manohar R.
• Granted Patent: US 8,479,295 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 11/3644 by instrumenting at runtime
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Generally, this disclosure describes systems and methods for transparently instrumenting a computer process. The systems and methods are configured to allow instrumenting executable code while permitting legacy memory scanning tools to monitor corresponding uninstrumented executable code stored in memory.

Claims

1. A method, comprising:

storing at least a portion of an executable application program in a host system physical memory at a first host physical address;

instrumenting a copy of said portion of said executable application program and storing said instrumented copy in said host system physical memory at a second host physical address;

setting a corresponding access permission to read only for said first host physical address and setting a corresponding access permission to execute only for said second host physical address; and

executing said instrumented copy or reading said portion of said executable application program based, at least in part, on said access permissions.

2. The method of claim 1, further comprising:

generating a page fault in response to an attempt to read said second host physical address or an attempt to execute said portion of said executable application program stored at said first host physical address.

3. The method of claim 2, further comprising:

determining a type of said page fault; and

updating an extended page table entry to correspond to said second host physical address if said page fault is an execute fault or to correspond to said first host physical address if said page fault is a read fault.

4. The method of claim 1, wherein a memory scanner is configured to read said portion of said executable application program.

5. The method of claim 1, further comprising:

generating a first extended page table associated with said first host physical address and a second extended page table associated with said second host physical address; and

instrumenting a memory scanner with a first instruction, said first instruction configured to select said first extended page table,

wherein said memory scanner is configured to read said portion of said executable application program and said first instruction is configured to be executed prior to said memory scanner reading said portion of said executable application program.

6. The method of claim 5, further comprising:

instrumenting said memory scanner with a second instruction, said second instruction configured to select said second extended page table,

wherein said second instruction is configured to be executed after said memory scanner has read said portion of said executable application program.

7. The method of claim 1, further comprising:

monitoring execution of said executable application program using said instrumented copy, wherein said monitoring is configured to detect malware.

8. The method of claim 1, further comprising:

generating a first extended page table associated with said first host physical address and a second extended page table associated with said second host physical address;

generating a page fault in response to an attempt to read said second host physical address or an attempt to execute said portion of said executable application program stored at said first host physical address; and

selecting one of said first and second extended page tables in response to the page fault.

9. A system comprising, one or more storage mediums having stored thereon, individually or in combination, instructions that, when executed by one or more processors, result in the following operations comprising:

storing at least a portion of an executable application program in a host system physical memory at a first host physical address;

instrumenting a copy of said portion of said executable application program and storing said instrumented copy in said host system physical memory at a second host physical address;

setting a corresponding access permission to read only for said first host physical address and setting a corresponding access permission to execute only for said second host physical address; and

executing said instrumented copy or reading said portion of said executable application program based, at least in part, on said access permissions.

10. The system of claim 9, wherein the instructions result in the following additional operations comprising:

generating a page fault in response to an attempt to read said second host physical address or an attempt to execute said portion of said executable application program stored at said first host physical address.

11. The system of claim 10, wherein the instructions result in the following additional operations comprising:

determining a type of said page fault; and

updating an extended page table entry to correspond to said second host physical address if said page fault is an execute fault or to correspond to said first host physical address if said page fault is a read fault.

12. The system of claim 9, wherein a memory scanner is configured to read said portion of said executable application program.

13. The system of claim 9, wherein the instructions result in the following additional operations comprising:

generating a first extended page table associated with said first host physical address and a second extended page table associated with said second host physical address; and

instrumenting a memory scanner with a first instruction, said first instruction configured to select said first extended page table,

wherein said memory scanner is configured to read said portion of said executable application program and said first instruction is configured to be executed prior to said memory scanner reading said portion of said executable application program.

14. The system of claim 13, wherein the instructions result in the following additional operations comprising:

instrumenting said memory scanner with a second instruction, said second instruction configured to select said second extended page table,

wherein said second instruction is configured to be executed after said memory scanner has read said portion of said executable application program.

15. The system of claim 9, wherein the instructions result in the following additional operations comprising:

monitoring execution of said executable application program using said instrumented copy wherein said monitoring is configured to detect malware.

16. The system of claim 9, wherein the instructions result in the following additional operations comprising:

generating a first extended page table associated with said first host physical address and a second extended page table associated with said second host physical address;

generating a page fault in response to an attempt to read said second host physical address or an attempt to execute said portion of said executable application program stored at said first host physical address; and

selecting one of said first and second extended page tables in response to the page fault.

17. A system, comprising:

host physical memory; and

a processor configured to;

store at least a portion of an executable application program in said host system physical memory at a first host physical address;

instrument a copy of said portion of said executable application program and store said instrumented copy in said host system physical memory at a second host physical address;

set a corresponding access permission to read only for said first host physical address and set a corresponding access permission to execute only for said second host physical address; and

execute said instrumented copy or read said portion of said executable application program based, at least in part, on said access permissions.

18. The system of claim 17, wherein the processor is further configured to:

generate a page fault in response to an attempt to read said second host physical address or an attempt to execute said portion of said executable application program stored at said first host physical address.

19. The system of claim 18, wherein the processor is further configured to:

determine a type of said page fault; and

updating an extended page table entry to correspond to said second host physical address if said page fault is an execute fault or to correspond to said first host physical address if said page fault is a read fault.

20. The system of claim 17, wherein the processor is further configured to:

generate a first extended page table associated with said first host physical address and a second extended page table associated with said second host physical address; and

instrument a memory scanner with a first instruction, said first instruction configured to select said first extended page table,

wherein said memory scanner is configured to read said portion of said executable application program and said first instruction is configured to be executed prior to said memory scanner reading said portion of said executable application program.

21. The system of claim 20, wherein the processor is further configured to:

instrument said memory scanner with a second instruction, said second instruction configured to select said second extended page table,

wherein said second instruction is configured to be executed after said memory scanner has read said portion of said executable application program.

22. The system of claim 17, wherein the processor is further configured to:

monitor execution of said executable application program using said instrumented copy, said monitoring is configured to detect malware.