Patent ID: 9596250
Date: 2017-03-14
CPC Classifications: G06F,H04L

Claim:
1. A method for preventing malicious memory scraping executable by a microprocessor, the method comprising the steps of: providing a predetermined software processes at a zero-ring level using physical RAM that can be opened as a section named “\\Device\\PhysicalMemory” with NtOpenSection( ); mapping with NtMapViewOfSection( ) native API functions which include Kernel highest level drivers, intermediate drivers and low level drivers in the NT Kernel and which communicate with Ring 3 (user land) applications to establish a 0 ring hook; mapping a targeted physical address with NtMapViewOfSection( ) pointer; providing write access to “\\Device\\PhysicalMemory” using NtOpenSection call to WRITEDAC and READCONTROL; and restoring a memory table;