System and Method Of Performing Online Memory Data Collection For Memory Forensics In A Computing Device

Various embodiments include methods and a memory data collection processor for performing online memory data collection for memory forensics. Various embodiments may include determining whether an operating system executing in a computing device is trustworthy. In response to determining that the operating system is not trustworthy, the memory data collection processor may collect memory data directly from volatile memory. Otherwise, the operating system to collect memory data from volatile memory. Memory data may be collected at a variable memory data collection rate determined by the memory data collection processor. The memory data collection rate may depend upon whether an available power level of the computing device exceeds a threshold power level, whether an activity state of the processor of the computing device equals a sleep state whether a security risk exists on the computing device, and whether a volume of memory traffic in the volatile memory exceeds a threshold volume.

BACKGROUND

Memory forensics is an analysis of a computer's volatile memory to determine information about executing programs, the operating system, and/or the overall state of the computer. Memory forensics may be useful for detecting malicious software (i.e., malware) executing in the computer's memory. Malware may include any software that is used to disrupt computer operations, gather sensitive information, gain access to private computer systems, or display unwanted advertising. Malware may include, but is not limited to, computer viruses, worms, rootkits, Trojan horses, ransomware, spyware, adware, scareware, and other malicious software.

Memory forensics typically involves collecting memory data that represents the state of the computer's volatile memory at a specific time and is sometimes referred to as creating a “memory snapshot” or “memory dump.” Types of memory data collected for memory forensics may include information on memory usage, such as map files, mem files, proc files, and other data about processes and other system information, for example.

Memory data collection may be performed offline or online. Offline memory data collection occurs when a computer is no longer operating, such as after a program crash due to a computer attack. With offline memory data collection, there is a risk of losing memory content before it is collected, particularly if power is lost. Online memory data collection occurs while the computer in operation. With online memory data collection, there is less risk of memory content loss and thus is more reliable.

SUMMARY

Various embodiments include methods and a memory data collection processor for performing online memory data collection for memory forensics in a computing device. Various embodiments may include a memory data collection processor determining whether an operating system executing in a computing device is trustworthy. In response to determining that the operating system is not trustworthy, the memory data collection processor may collect memory data directly from volatile memory. In response to determining that the operating system is trustworthy, the memory data collection processor may call the operating system to collect memory data from volatile memory.

In some embodiments, collecting memory data from the volatile memory may include collecting the memory data from the volatile memory at a variable memory data collection rate determined by the memory data collection processor. Some embodiments may further include the memory data collection processor determining whether an available power level of the computing device exceeds a threshold power level, and setting the variable memory data collection rate at or near a maximum rate in response to determining that the available power level of the computing device exceeds the threshold power level. Some embodiments may further include the memory data collection processor determining whether an activity state of the processor of the computing device equals a sleep state, and setting the variable memory data collection rate towards a minimum rate in response to determining that the activity state of the processor is equal to the sleep state. Some embodiments may further include the memory data collection processor obtaining information indicating whether a security risk exists on the computing device, and setting the variable memory data collection rate at or near a maximum rate in response to determining that the information indicates that a security risk exists on the computing device. Some embodiments may further include the memory data collection processor determining whether a volume of memory traffic in the volatile memory exceeds a threshold volume, setting the variable memory data collection rate at or near a maximum rate in response to determining that the volume of memory traffic in the volatile memory exceeds the threshold volume, and setting the variable memory data collection rate at or near a minimum rate in response to determining that the volume of memory traffic in the volatile memory does not exceed the threshold volume.

In some embodiments, collecting memory data from the volatile memory may include the memory data collection processor collecting a partial data set from the volatile memory, in which the partial data set includes data associated with one or more suspicious processes executing in the volatile memory. In some embodiments, collecting memory data from the volatile memory may include collecting a partial data set from the volatile memory, wherein the partial data set includes less than all data associated with each process executing in the volatile memory. In some embodiments, determining whether the operating system executing in the volatile memory is trustworthy may include the memory data collection processor determining whether the operating system satisfies a real time integrity check.

Further embodiments may include a computing device having a volatile memory, a processor coupled to the memory, and a memory data collection processor coupled to the memory and the processor and configured to perform operations of the methods summarized above. Further embodiments may include a computing device having means for performing functions of the methods summarized above. Further embodiments may include a non-transitory medium on which is stored processor-executable instructions configured to cause a memory data collection processor to perform operations of the methods summarized above.

DETAILED DESCRIPTION

Various embodiments include methods and hardware implementing such methods for efficiently performing memory collections (i.e., “snapshots”) on computing devices.

The term “computing device” is used herein to refer to an electronic device equipped with at least a processor. Examples of computing devices may include, but not limited to, mobile communication devices (e.g., cellular telephones, wearable devices, smart-phones, web-pads, tablet computers, Internet enabled cellular telephones, Wi-Fi® enabled electronic devices, personal data assistants (PDA's), laptop computers, etc.), personal computers, and servers. In various embodiments, computing devices may be configured with memory and/or storage as well as wireless communication capabilities, such as network transceiver(s) and antenna(s) configured to establish a wide area network (WAN) connection (e.g., a cellular network connection, etc.) and/or a local area network (LAN) connection (e.g., a wireless connection to the Internet via a Wi-Fi® router, etc.).

Operating systems typically provide application program interfaces (“APIs”) and/or file systems that may be used for online collection of memory data associated with one or more processes, e.g., for memory forensics. For example, in Unix-like operating systems (OS), a proc filesystem (“procfs”) may be used to access information about processes and other system information maintained in the OS in a hierarchical file-like structure. However, an OS cannot necessarily be trusted, particularly when the computer is suspected of executing malware or under attack by a malicious computer hacker. For example, a malicious computer attack may compromise the integrity of an OS, configuring the OS to provide the inaccurate information regarding the memory content for a specific process, thus defeating memory forensic techniques.

Various embodiments are disclosed for performing online memory data collection using a memory data collection processor to ensure accurate data collections are reliably performed in the event the OS is compromised. Various embodiments may include determining whether the operating system (“OS”) executing in the volatile memory of a computing device is trustworthy. In response to determining that the OS is trustworthy, the memory data collection processor may call the OS to collect the memory data. In response to determining that the OS may not be trustworthy, the memory data collection processor may read the memory data direct from the volatile memory. In some embodiments, the memory data collection processor may determine whether the OS is trustworthy by determining whether the OS satisfies a real-time integrity check (RTIC). In some embodiments, the memory data collection processor may be an electronic component external to a processor that executes the OS in the volatile memory.

In some embodiments, the memory data collection processor may be configured to perform online memory data collection at a variable memory data collection rate that depends on certain factors or triggers. Such factors or triggers may include, but are not limited to, an available power level of the computing device (e.g., battery life), the activity state of the processor, whether a security risk exists on the computing device, the volume of memory traffic (i.e., reads/write accesses), and any combination thereof. Various embodiments may be particularly useful for memory forensics.

FIG. 1is a schematic diagram illustrating components of a computing device100that may be configured to perform online memory data collection according to some embodiments. The computing device100may include various circuits and other electronic components used to power and control the operation of the computing device100. The computing device100may include a processor110, memory112, a memory data collection processor120, a radio frequency (RF) processor130coupled to an antenna132, and a power supply140.

In some embodiments, the processor110may be dedicated hardware specifically adapted to perform various operations of the computing device100, including, but not limited to, executing an operating system and/or various instances of one or more programs (i.e., processes). In some embodiments, the processor110may be or include a programmable processing unit111that may be programmed with processor-executable instructions to perform the various operations of the computing device100. In some embodiments, the processor110may be a programmable microprocessor, microcomputer or multiple processor chip or chips that can be configured by software instructions to perform the various operations of the computing device100. In some embodiments, the processor110may be a combination of dedicated hardware and a programmable processing unit111.

In some embodiments, the memory112may store processor-executable instructions. In some embodiments, the memory112may be volatile memory, nonvolatile memory (e.g., flash memory), or a combination thereof. In some embodiments, the memory112may include internal memory included in the processor110, memory external to the processor110, or a combination thereof. In some embodiments, the memory112may include volatile memory114, such as random access memory (RAM), in which an operating system and various instances of one or more programs (i.e., processes) may be executed by the processor110.

In some embodiments, the memory collection processor120may be dedicated hardware specifically adapted to perform online memory data collection for memory forensics in the computing device100. In some embodiments, the memory data collection processor120may include a memory dump storage122and a programmable control unit124that may be programmed with processor-executable instructions to control performance of the online memory data collection from the volatile memory114using the memory dump storage122. In some embodiments, the memory data collection processor110may be a combination of dedicated hardware, the memory dump storage122, and the programmable control unit124. In some embodiments, the memory data collection processor120may be a programmable microprocessor, microcomputer or multiple processor chip or chips that can be configured by software instructions to perform online memory data collection from the volatile memory114using the memory dump storage122.

In some embodiments, the memory data collection processor120may optionally include a memory forensics analyzer126that performs a memory forensics analysis on the memory data collected in the memory dump storage122. In some embodiments, the memory forensics analysis may be performed by a remote computing device (e.g.,150).

In some embodiments, the processor110and the memory data collection processor120may be coupled to the RF processor130in order to communicate with a remote computing device150. For example, in some embodiments, the RF processor130may be configured to receive and transmit signals134via the antenna132, such as signals from/to a remote computing device150. Such a remote computing device150may perform a memory forensics analysis on data collected by the memory data collection processor120and transmitted via the RF processor130. The RF processor130may provide information received from a remote computing device150to the processor110and/or the memory data collection processor120. The RF processor130may be a transmit-only or a two-way transceiver processor. For example, the RF processor130may include a single transceiver chip or a combination of multiple transceiver chips for transmitting and/or receiving signals. The RF processor130may operate in one or more of a number of radio frequency bands depending on the supported type of communications.

The remote computing device150may be any of a variety of computing devices, including but not limited to a processor in cellular telephones, smart-phones, web-pads, tablet computers, Internet enabled cellular telephones, wireless local area network (WLAN) enabled electronic devices, laptop computers, personal computers, server and similar electronic devices equipped with at least a processor and a communication resource to communicate with the RF processor130. Information may be transmitted from one or more components of the computing device100(e.g., the processor110or the memory data collection processor120) to the remote computing device150over a wireless link134using Bluetooth®, Wi-Fi® or other wireless communication protocol.

The processor110, the memory112, the memory data collection processor120, the RF processor130, and any other electronic components of the control device100may be powered by the power supply140. In some embodiments, the power supply140may be a battery, a solar cell, or other type of energy harvesting power supply.

While the various components of the computing device100are illustrated inFIG. 1as separate components, some or all of the components may be integrated together in a single device or module, such as a system-on-chip module.

FIG. 2illustrates a method200of performing online memory data collection according to some embodiments. With reference toFIGS. 1-2, operations of the method200may be performed by a memory data collection processor of the computing device (e.g.,120ofFIG. 1).

In determination block210, the memory data collection processor (e.g.,120) may determine whether the operating system executing in volatile memory (e.g. the volatile memory114ofFIG. 1) is trustworthy. In some embodiments, the memory data collection processor may determine whether an operating system is trustworthy or not based on unexpected changes to one or more OS files or attributes thereof, such as credentials, privileges and security settings, content, core attributes and size, hash values and configuration values. Such changes may increase the risk of a security breach and/or may indicate a security breach in progress.

In some embodiments, the memory data collection processor (e.g.,120) may determine whether the operating system is trustworthy by determining whether the operating system executing in the volatile memory (e.g.,114) satisfies a real time integrity check. A real time integrity check may validate the integrity of one or more OS files or attributes thereof by comparing the current state of such files or file attributes against previously known baselines. For example, in some embodiments, the real time integrity check may include calculating checksums of one or more OS files or file attributes and comparing the calculated checksum against known checksums of such OS files or file attributes.

In some embodiments, the memory data collection processor (e.g.,120) may execute a real time integrity check. In some embodiments, the memory data collection processor (e.g.,120) may obtain the result of a real time integrity check performed by another electronic component of the computing device (e.g.,100). In some embodiments, the real time integrity check may be performed randomly, periodically, quasi-periodically, or each time a memory data collection is to be performed.

In some embodiments, other methods for determining whether the operating system is trustworthy may be employed in block210, such as malware detection software, such as a security monitoring application or service.

In response to determining that the operating system is not trustworthy (i.e., determination block210=“Not trustworthy”), the memory data collection processor (e.g.,120) may collect memory data from the volatile memory (e.g.,114) by reading the memory data directly from the volatile memory in block220. For example, in some embodiments, the memory data collection processor (e.g.,120) may command, request, or otherwise enable the memory dump storage (e.g.,122ofFIG. 1) to read memory data direct from the volatile memory (e.g.,114). In some embodiments, the memory dump storage (e.g.,122) may be configured to read the memory data direct from the volatile memory (e.g.,114) using direct memory access (DMA) or peer-to-peer transfers over a bus architecture. In some embodiments, all write access to the volatile memory (e.g.,114) may be disabled while the memory data is collected. Disabling write access while memory data is collect ensures that a complete image of the memory is obtained.

In response to determining that the operating system is trustworthy (i.e., determination block210=“Trustworthy”), the memory data collection processor (e.g.,120) may collect memory data from the volatile memory (e.g.,114) by calling the operating system to collect the memory data from the volatile memory in block230. For example, in some embodiments, the memory data collection processor (e.g.,120) may send signals (e.g., messages) to a processor executing the operating system (e.g.,110) in order to execute one or more OS function calls defined by one or more application program interfaces (“APIs”) or file systems that may be used to collect memory data.

In some embodiments, the memory data collected in blocks220or230may include all of the memory data stored in the volatile memory (e.g.,114). In some embodiments, the collected memory data may include a partial data set of all the memory data contained in the volatile memory, thereby reducing the power consumption, processing costs and other overhead associated with each memory data collection.

For example, in some embodiments, the partial data set collected in block220may include only data associated with one or more suspicious processes executing in the volatile memory. The process identifiers (PIDs) of one or more instances of programs executing in the volatile memory may be identified or marked as suspicious by a security monitoring application or service. In some embodiments, the processor (e.g.,110) or other electronic component of the computing device (e.g.,100) may execute the security monitoring application or service. By collecting memory data associated with only suspicious processes, memory forensics analysis may focus on processes that are security risks while reducing potential performance impacts on the computing device (e.g.,100).

In some embodiments, the partial data set may include a subset of data (i.e., less than all data) for all processes executing in the volatile memory (e.g.,114). For example, in some embodiments, the partial data set for every process may include a set of specific facts (e.g., the memory assigned to each process, the number of forks executed, etc.). By collecting a subset of data associated with each process, memory forensics analysis may focus on analyzing data that is more likely to indicate security risks or security breaches that are in progress while reducing potential performance impacts on the computing device (e.g.,100).

In block240, the memory data collection processor (e.g.,120) may transmit the collected memory data to a memory forensics analyzer. For example, in some embodiments, the memory data collection processor (e.g.,120) may transmit the collected memory data from the memory dump storage (e.g.,122ofFIG. 1) to a remote computing device (e.g.,150ofFIG. 1) to perform a memory forensics analysis on the collected memory data. In some embodiments, the memory data collection processor (e.g.,120) may cause the collected memory data to be internally transmitted from the memory dump storage (e.g.,122ofFIG. 1) to an internal memory forensics analyzer (e.g.,126ofFIG. 1). In some embodiments, the optional memory forensics analyzer (e.g.,126) may be included in the memory data collection processor (e.g.,120). In some embodiments, the optional memory forensics analyzer (e.g.,126) may be included in another electronic component of the computing device (e.g.,100).

Online memory data collection may impose overhead in terms of power consumption, communication bandwidth utilization, and other processing costs. In some embodiments, online memory data collection may be performed at a variable memory collection rate based on a tradeoff between collecting memory data frequently and reducing such overhead.FIG. 3is a flow diagram illustrating a method300of controlling a rate of performing the online memory data collection ofFIG. 2according to some embodiments. With reference toFIGS. 1-3, operations of the method300may be performed by a memory data collection processor (e.g.,120ofFIG. 1) of a computing device (e.g.,100ofFIG. 1).

In block310, the memory data collection processor (e.g.,120) may determine an available power level of the computing device. For example, in some embodiments, when the power supply of the computing device (e.g.,140) is coupled to a continuous power source (e.g., plugged into a power wall outlet), the controller may determine that the available power level is 100 percent. In some embodiments, when the power supply (e.g.,140) is a battery, the controller may determine the percentage of available power remaining in the battery for powering the various electronic components of the computing device (e.g.,100).

In determination block315, the memory data collection processor (e.g.,120) may determine whether the available power level exceeds a threshold power level. For example, in some embodiments, the memory data collection processor (e.g.,120) may set the threshold power level to an arbitrary power level (e.g., 75%).

In response to determining that the available power level exceeds the threshold power level (i.e., determination block315=“Yes”), the memory data collection processor may adjust the variable memory data collection rate at or near a maximum rate (i.e., block320). In some embodiments, the maximum rate may be the maximum rate at which a memory forensics analyzer (e.g.,126) is capable of analyzing set of memory data. For example, when the computing device (e.g.,100) receives power from a continuous power source or a battery having sufficient battery life, the memory data collection processor (e.g.,120) may perform online memory data collection at or near the maximum rate.

In response to determining that the available power level is equal to or less than the threshold power level (i.e., determination block315=“No”), the memory data collection processor may determine an activity state of a processor of the computing device (e.g., the processor110) in block325. For example, the memory data collection processor (e.g.,120) may send signals (e.g., messages) to the processor (e.g.,110) to request information indicating whether the processor is operating in a sleep state (e.g., a low activity state indicative of low or no activity), an active state (e.g., a high activity state indicative the processor performing processor-intensive tasks), or an intermediate state between a sleep state and an active state. In some embodiments, the memory data collection processor (e.g.,120) may determine the activity state of the processor (e.g.,110) by accessing a memory register that indicates the activity state of the processor (e.g., activity state flags). The memory register may be maintained in the processor, in the memory (e.g.,112), or in another electronic component of the computing device (e.g.,100).

In determination block330, the memory data collection processor (e.g.,120) may determine whether the activity state of the processor is a sleep state.

In response to determining that the activity state of the processor is a sleep state (i.e., determination block330=“Yes”), the memory data collection processor (e.g.,120) may set the variable memory data collection rate at or near a minimum rate in block355. For example, when the processor (e.g.,110) is sleeping, changes to memory data in the volatile memory (e.g.,114) due to read/write accesses are likely to be minimal. Thus, the need for collecting and performing memory forensics analysis on memory data in the volatile memory is also likely to be less.

In response to determining that the activity state of the processor does not equal a sleep state (i.e., determination block330=“No”), the memory data collection processor (e.g.,120) may obtain information indicative of whether a security risk exists on the computing device in block335. For example, in some embodiments, the information may include process identifiers (PIDs) of one or more instances of programs executing in the volatile memory (e.g.,114) that may be identified or marked as suspicious by a security monitoring application or service. In some embodiments, the processor (e.g.,110) or other electronic component of the computing device (e.g.,100) may execute the security monitoring application or service.

In determination block340, the memory data collection processor (e.g.,120) may determine whether the information indicates that a security risk exists on the computing device (e.g.,100). For example, in some embodiments, identification of at least one process as suspicious may be sufficient to determine that a security risk exists in the computing device.

In response to determining that the information indicates that a security risk exists on the computing device (i.e., determination block340=“Yes”), the memory data collection processor (e.g.,120) may set the variable memory data collection rate at or near a maximum rate in block320.

In response to determining that the information does not indicate that a security risk exists (i.e., determination block340=“No”), the memory data collection processor (e.g.,120) may determine the volume of memory traffic in the volatile memory in block345. For example, in some embodiments, the volume of memory traffic may be determined by tracking the number of read/write accesses over a set period of time on an internal bus or other communications link between the processor (e.g.,110) and the volatile memory (e.g.,114). In some embodiments, other techniques may be used to determine the volume of memory traffic.

In determination block350, the memory data collection processor (e.g.,120) may determine whether the volume of memory traffic exceeds a threshold volume. For example, in some embodiments, the threshold volume may be a predetermined number of read/write accesses tracked or detected between the processor (e.g.,110) and the volatile memory (e.g.,114). As the amount of memory traffic increases, the risk of malware being written to the volatile memory (e.g.,114) and executed by the processor (e.g.,110) or other electronic component may also increase.

In response to determining that the volume of memory traffic exceeds the threshold volume (i.e., determination block350=“Yes”), the memory data collection processor (e.g.,120) may set the variable memory data collection rate at or near a maximum rate in block320. Otherwise, in response to determining that the volume of memory traffic does not exceed the threshold volume (i.e., determination block350=“No”), the memory data collection processor (e.g.,120) may set the memory collection rate at or near a minimum rate in block355.

The operations in the method300may be performed periodically and/or in response to various events (e.g., a change in power state, detection of malware, etc.) to adjust the memory data collection rate to match current conditions of the computing device.

The various embodiments may be implemented on any of a variety of commercially available computing devices. For example,FIG. 4is a schematic diagram illustrating components of a smartphone type mobile communication device600that may be configured to implement methods according to some embodiments, including the embodiments of the methods200and300described with reference toFIGS. 2 and 3. A mobile communication device400may include a processor402coupled to a touchscreen controller404and an internal memory406. The processor402may be one or more multi-core integrated circuits designated for general or specific processing tasks. The internal memory406may be volatile or non-volatile memory. The touchscreen controller404and the processor402may also be coupled to a touchscreen panel412, such as a resistive-sensing touchscreen, capacitive-sensing touchscreen, infrared sensing touchscreen, etc. Additionally, the display of the communication device400need not have touch screen capability. Additionally, the mobile communication device400may include a cellular network transceiver408coupled to the processor402and to an antenna410for sending and receiving electromagnetic radiation that may be connected to a wireless data link. The transceiver408and the antenna410may be used with the above-mentioned circuitry to implement various embodiment methods.

The mobile communication device400may have a cellular network transceiver408coupled to the processor402and to an antenna410and configured for sending and receiving cellular communications. The mobile communication device400may include one or more subscriber identity module (SIM) cards416,418coupled to the transceiver408and/or the processor402and may be configured as described above.

The mobile communication device400may also include speakers414for providing audio outputs. The mobile communication device400may also include a housing420, constructed of a plastic, metal, or a combination of materials, for containing all or some of the components discussed herein. The mobile communication device400may include a power source422coupled to the processor402, such as a disposable or rechargeable battery. The rechargeable battery may also be coupled to the peripheral device connection port to receive a charging current from a source external to the communication device400. The communication device400may also include a physical button424for receiving user inputs. The mobile communication device400may also include a power button426for turning the mobile communication device400on and off.

Other forms of computing devices, including personal computers and laptop computers, may be used to implementing the various embodiments. For example,FIG. 5is a schematic diagram illustrating components of a laptop computing device500that may be configured to implement methods according to some embodiments, including the embodiments of the methods200and300described with reference toFIGS. 2 and 3. In some embodiments, the laptop computing device500may include a touch pad514that serves as the computer's pointing device, and thus may receive drag, scroll, and flick gestures similar to those implemented on mobile computing devices equipped with a touch screen display and described above. Such a laptop computing device500generally includes a processor501coupled to volatile internal memory502and a large capacity nonvolatile memory, such as a disk drive506. The laptop computing device500may also include a compact disc (CD) and/or DVD drive508coupled to the processor501. The laptop computing device500may also include a number of connector ports510coupled to the processor501for establishing data connections or receiving external memory devices, such as a network connection circuit for coupling the processor501to a network. The laptop computing device500may have one or more radio signal transceivers518(e.g., Peanut®, Bluetooth®, ZigBee®, Wi-Fi®, RF radio) and antennas520for sending and receiving wireless signals as described herein. The transceivers518and antennas520may be used with the above-mentioned circuitry to implement the various wireless transmission protocol stacks/interfaces. In a laptop or notebook configuration, the computer housing includes the touch pad514, the keyboard512, and the display516all coupled to the processor501. Other configurations of the computing device may include a computer mouse or trackball coupled to the processor (e.g., via a universal serial bus (USB) input) as are well known, which may also be used in conjunction with the various embodiments.

FIG. 6is a schematic diagram illustrating components of a server600that may be configured to implement methods according to some embodiments, including the embodiments of the methods200and300described with reference toFIGS. 2 and 3. Such a server600typically includes a processor601coupled to volatile memory602and a large capacity nonvolatile memory, such as a disk drive603. The server600may also include a floppy disc drive, compact disc (CD) or DVD disc drive606coupled to the processor601. The server600may also include network access ports604coupled to the processor601for establishing data connections with a network605, such as a local area network coupled to other broadcast system computers and servers.

The processor601may be any programmable microprocessor, microcomputer or multiple processor chip or chips that can be configured by software instructions (applications) to perform a variety of functions, including the functions of the various embodiments described above. In some embodiments, multiple processors may be provided, such as one processor dedicated to wireless communication functions and one processor dedicated to running other applications. Typically, software applications may be stored in the internal memory602,603before they are accessed and loaded into the processor601. The processor601may include internal memory sufficient to store the application software instructions.

The various embodiments illustrated and described are provided merely as examples to illustrate various features of the claims. However, features shown and described with respect to any given embodiment are not necessarily limited to the associated embodiment and may be used or combined with other embodiments that are shown and described. Further, the claims are not intended to be limited by any one example embodiment.