Runtime detection of code modification
US10628167B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Feb 21, 2018 |
| Grant date | Apr 21, 2020 |
| Priority date | — |
| Expiry date | Aug 27, 2038 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/566
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A new layer for runtime detection of vendor hooks, with respect to a program module, includes mapping of branching instructions and their respective targets. When the program module is compiled, branch instructions are mapped and recorded to generate one or more branch maps. A branch map includes target program module addresses (or associated respective placeholders) and respective instruction offsets. At runtime, placeholders are replaced with respective target program module addresses. At runtime, actual branching information is compared to branching information included in the branch map. If a discrepancy is detected between runtime branching information and the corresponding branching information recorded in the branch map, a responsive action is triggered.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.