Patent ID: 11934534
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 14:
15. A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:
performing dynamic vulnerability detection of a driver while the driver is executing in a computing system, the dynamic vulnerability detection comprising:
detecting at least one offset made available by the driver for access to the driver; and
detecting application programming interface (API) calls made by the driver;
performing static vulnerability detection of the driver by analyzing binary code of the driver,
the static vulnerability detection comprising:

determining the at least one offset available for access to the driver; and
identifying vulnerable code paths to functions accessing kernel functionality; and
determining if the driver is vulnerable based on results from the dynamic vulnerability detection and the static vulnerability detection; and
automatically disabling the driver in the computer system for access by other programs based on the determining that the driver is vulnerable.