Patent ID: 8104089
Filing Date: 2012-01-24
Classification: G06F

Abstract:
1. A computer program product for protecting a host computer system against dynamically unpacked malicious code, the computer program product comprising a non-transitory computer-readable storage medium containing executable computer program code for: detecting an attempt by a program to unpack code by writing to a memory page on the host computer system that is set to be executable but not writable, wherein the attempt by the program to unpack the code is made by addressing the memory page using a first address; intercepting an exception to allow the program to unpack the code by writing to the memory page; tracking a shared memory region in the host computer system to determine a plurality of addresses mapped to the memory page responsive to the exception, the plurality of addresses including the first address and a second address distinct from the first address that both map to the memory page; marking each of the plurality of addresses that maps to the memory page to be writable but non-executable thereby allowing the program to unpack the code to the memory page; detecting an attempt by the program to execute the unpacked code on the memory page by addressing the memory page using the second address; before executing the unpacked code on the memory page, scanning the memory page for malicious code; and executing the unpacked code on the memory page if the scanning does not identify malicious code.