Patent ID: 9703726
Date: 2017-07-11
CPC Classifications: G06F

Claim:
1. A method comprising employing at least one hardware processor of a host system to execute a memory introspection engine, the memory introspection engine executing outside of a virtual machine exposed by the host system, the virtual machine comprising a virtualized processor and a virtualized physical memory, the virtual machine configured to employ the virtualized processor to execute a target thread of a process, and wherein executing the memory introspection engine comprises: identifying within a virtual memory space of the process a target page reserved for a call stack of the target thread, wherein identifying the target page comprises determining an address of a top of the call stack, and determining whether the target page is reserved for the call stack according to the address; determining according to a page table of the virtual machine whether the target page is mapped to the virtualized physical memory; and in response to determining whether the target page is mapped to the virtualized physical memory, when the target page is not mapped to the virtualized physical memory: