Patent ID: 8566944
Filing Date: 2013-10-22
Classification: G06F

Abstract:
1. A method comprising: performing static analysis on code of an operating system to identify data types of the operating system; forming an extended type graph reflecting the data types identified by the static analysis of the code; obtaining a raw memory snapshot of a computer memory of a computing device during runtime of the operating system, the raw memory snapshot including the operating system executing on the computing device; finding dynamic data structures and individual data types of the dynamic data structures in the raw memory snapshot using the extended type graph, wherein the dynamic data structures include one or more function pointers and are allocated or freed during runtime of the operating system; forming an object graph from static data structures of the operating system and the dynamic data structures that include the one or more function pointers; defining an authorized memory area having executable code, the static data structures, and the dynamic data structures; and checking the one or more function pointers included in the dynamic data structures that are allocated or freed during the runtime of the operating system and validating that the one or more function pointers reference one or more valid memory locations in the authorized memory area to validate whether the computer memory is uncompromised.