Patent ID: 11948008
Assignee: HEWLETT-PACKARD DEVELOPMENT COMPANY, L.P.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 5:
6. A method comprising:
initiating a system management (SM) execution mode of a computing system in response to an interruption to normal operation of an operating system of the computing system, wherein individual processes of the operating system that are implemented during normal operation of the operating system are identified by a process pool tag;
during the SM execution mode,
scanning memory of the computing system to detect a process pool tag;
generating a signature for the process pool tag that is detected;
comparing the signature generated for the process pool tag that is detected to a set of signatures of process pool tags that are known to be implemented during normal operation of the operating system;
detecting a coherency discrepancy based on comparing the signature generated for the process pool tag and the set of signatures of the process pool tags that are known to be implemented during normal operation of the operating system, wherein the coherency discrepancy indicates a malware infection in the computing system;
writing a coherency discrepancy data structure with data related to the coherency discrepancy to an allocated memory accessible by the operating system following exit from the SM execution mode; and
exiting the SM execution mode of the computing system.