Synchronous execution of designated computing events using hardware-assisted virtualization

• US 9,904,782 B2
• Filed: 10/27/2015
• Issued: 02/27/2018
• Est. Priority Date: 10/27/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Woodward, Carl D., Mankin, Jennifer, Rubakha, Dmitri, Shanmugavelayutham, Palanivel Rajan, Sukhomlinov, Vadim
• Primary Examiner(s): LEUNG, ROBERT B
• Application Number:
  US14/924,493
• Publication Number:
  US 20170116419A1
• Time in Patent Office: 854 Days
• CPC Class Codes: G06F 12/10 Address translation
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2212/657 Virtual address space management
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45516 Runtime code conversion or optimisation
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications

Abstract

Providing synchronous processing of the designated computing events using hardware-assisted virtualization technology by performing at least the following: detecting a designated computing event using a high priority, low capability routine, creating a copy code in an alternate memory space of a first code located in a first memory space, modifying the copy code to call for analysis of at least a portion of the copy code that corresponds to the first code, switching execution of the first code with the modified copy code using an address translation data structure that translates a guest memory address to a host memory address after a return of the high priority, low capability routine; and analyzing synchronously the at least a portion of the code within the copy code that corresponds to the first code based on the replacement of the first code with the modified copy code.

Claims

1. A non-transitory machine readable medium on which are stored instructions, the stored instructions comprising instructions that when executed cause a machine for providing synchronous processing of designated computing events to:

detect a designated computing event using a high priority, low capability routine;

create a copy code in an alternate memory space of a first code located in a first memory space;

modify the copy code to call for analysis of at least a portion of the copy code that corresponds to the first code;

update an address translation data structure so that the modified copy code is executed instead of the first code, the address translation data structure configured to translate a guest memory address to a host memory address after a return of the high priority, low capability routine; and

analyze synchronously the portion of the copy code that corresponds to the first code.

2. The non-transitory machine readable medium of claim 1, wherein the designated computing event is a security event that represents a potential harm to the machine.

3. The non-transitory machine readable medium of claim 2, wherein the instructions, when executed, causes the machine to:

determine whether security event is benign based at least in part on analyzing the at least a portion of the copy code that corresponds to the first code; and

resume the first code located in the first memory space based on a determination that the security event is benign.

4. The non-transitory machine readable medium of claim 3, wherein the instructions, when executed, causes the machine to repair the first code located in the first memory space based at least on a determination that the security event is harmful to the machine.

5. The non-transitory machine readable medium of claim 3, wherein the instructions, when executed, causes the machine to terminate one or more instructions within the first code based at least on a determination that the security event is harmful to the machine.

6. The non-transitory machine readable medium of claim 1, wherein the instructions that cause the machine to update the address translation data structure so that the modified copy code is executed instead of the first code comprises instructions that cause the machine to enforce replacement of the first code with the modified copy code for a segment of the first code that caused the designated computing event.

7. The non-transitory machine readable medium of claim 6, wherein the replacement of the first code with the modified copy code is not enforced for other code not related to the designated computing event.

8. The non-transitory machine readable medium of claim 1, wherein the address translation data structure is adapted to perform a second level address translation that provides hardware-assisted virtualization of the machine.

9. The non-transitory machine readable medium of claim 1, wherein the instructions, when executed, causes the machine to:

execute the high priority, low capability routine such that the high priority, low capability routine interrupts one or more current instructions for a processor; and

analyze the at least a portion of the copy code that corresponds to the first code prior to resuming the one or more current instructions for the processor.

10. The non-transitory machine readable medium of claim 1, wherein the designated computing event is raised in a user mode, and wherein the instructions, when executed causes the machine to analyze the at least a portion of the copy code that corresponds to the first code in a user mode context.

11. The non-transitory machine readable medium of claim 1, wherein the designated computing event is raised in a kernel mode, and wherein the instructions, when executed causes the machine to analyze the at least a portion of the copy code that corresponds to the first code in a kernel mode context.

12. A system for providing synchronous processing of designated computing events, comprising:

at least one processor; and

a memory, coupled to the at least one processor, and comprises instructions, when executed by the at least one processor causes the system to;

detect a designated computing event using a high priority, low capability routine, wherein the high priority, low capability routine interrupts a current process handled by the at least one processor;

create a plurality of copy code instructions located in an alternate memory space that copies a plurality of original code instructions located in an original memory space;

generate modified copy code instructions by adding a plurality of analysis instructions to the plurality of copy code instructions, the plurality of analysis instructions calling for analysis of at least a portion of the plurality of copy code instructions that match the plurality of original code instructions;

execute the modified copy code instructions by mapping a guest memory address to a host memory address that references the alternate memory space with an address translation data structure; and

during execution of the modified copy code instructions, analyze synchronously at least some of the plurality of copy code instructions that were copied from the plurality of original code instructions.

13. The system of claim 12, wherein the designated computing event is a security event that represents potential malware.

14. The system of claim 12, wherein the instructions that cause the system to execute the modified copy code instructions by mapping the guest memory address to the host memory address that references the alternate memory space with the address translation data structure comprise instructions that cause the system to enforce mapping the guest memory address to the host memory address that references the alternate memory space for the original code instructions that caused the designated computing event.

15. The system of claim 14, wherein the mapping the guest memory address to the host memory address that references the alternate memory space is not enforced for other code not related to the designated computing event.

16. The system of claim 12, wherein the address translation data structure is adapted to perform a second level address translation that provides hardware-assisted virtualization of the system.

17. The system of claim 12, wherein the instructions, when executed by the at least on processor, causes the system to analyze at least some of the copy code instructions that were copied from the original code instructions during execution of the modified copy code instructions prior to resuming the current process for the at least one processor.

18. A method for providing synchronous processing of designated computing events, comprising:

detecting, using a programmable device, a designated computing event using a high priority, low capability routine, wherein the high priority, low capability routine interrupts one or more instructions currently handled by at least one processor;

copying, using the programmable device, an original memory page to create an alternate memory page;

modifying, using the programmable device, the alternate memory page such that the alternate memory page calls for further analysis of at least one instruction in the alternate memory page that matches the original memory page;

mapping, using the programmable device, a guest memory address to a host memory address that references the alternate memory page with an address translation data structure;

executing, using the programmable device, code in the modified alternate memory page; and

analyzing synchronously, using the programmable device, the at least one instruction in the alternate memory page that matches the original memory page during execution of the code.

19. The method of claim 18, further comprising enforcing, using the programmable device, mapping the guest memory address to the host memory address that references the alternate memory page for instructions within the original memory page that caused the designated computing event.

20. The method of claim 18, wherein the mapping the guest memory address to the host memory address that references the alternate memory page is not enforced for other instructions not related to the designated computing event.

21. The method of claim 18, wherein the address translation data structure performs a second level address translation that provides hardware-assisted virtualization of the programmable device.

22. The method of claim 18, wherein analyzing the at least one instruction in the alternate memory page that matches the original memory page during execution of code in the modified alternate memory page is performed prior to resuming the one or more instructions currently handled by at least one processor.

23. A non-transitory machine readable medium on which instructions are stored, comprising instructions that when executed cause a machine to:

detect a designated computing event using a high priority, low capability routine, wherein the high priority, low capability routine interrupts one or more instructions currently processed by at least one processor;

copy an original memory page to create an alternate memory page;

modify the alternate memory page such that the alternate memory page calls for further analysis of at least one instruction in the alternate memory page that matches the original memory page;

map a guest memory address to a host memory address that references the alternate memory page with an address translation data structure;

execute code in the modified alternate memory page; and

analyze synchronously the at least one instruction in the alternate memory page that matches the original memory page during execution of the code.

24. The non-transitory machine readable medium of claim 23, wherein the mapping of the guest memory address to the host memory address that references the alternate memory page is not enforced for other instructions not related to the designated computing event.

25. The non-transitory machine readable medium of claim 23, wherein the address translation data structure is adapted to perform a second level address translation that provides hardware-assisted virtualization of the machine.