Patent SG-11201811216W-A (SG)
Title: Kernel-based detection of target application functionality using offset-based virtual address mapping
Inventor: DE SUBRATO KUMAR
IPC: G06F21/56
Filed: 2017-06-30
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) .,.., (19) World Intellectual Property 1111111111111 0 III 011111111 OH 10 1 0 111101 011 0113100 11111110 111111111111 Organization International Bureau (10) International Publication Number i (43) International Publication Date ......'\"' WO 2018/022257 Al 01 February 2018 (01.02.2018) W I P0 I P C T (51) International Patent Classification: (71) Applicant: QUALCOMM INCORPORATED [US/US]; GO6F 21/53 (2013.01) GO6F 11/36 (2006.01) ATTN: International IP Administration, 5775 Morehouse G06F 21/56 (2013.01) Drive, San Diego, California 92121-1714 (US). (21) International Application Number: (72) Inventors: DE, Subrato Kumar; 5775 Morehouse Drive, PCT/US2017/040502 San Diego, California 92121 (US). GEORGE, Sajo Sun- (22) International Filing Date: der; 5775 Morehouse Drive, San Diego, California 92121 30 June 2017 (30.06.2017) (US). (74) Agent: WIGMORE, Steven, P. et al.; Smith Tempel Bla- (25) Filing Language: English ha LLC, Two Ravinia Drive, Suite 700, Atlanta, Georgia (26) Publication Language: English 30346 (US). (30) Priority Data: (81) Designated States (unless otherwise indicated, for every 62/368,223 29 July 2016 (29.07.2016) US kind of national protection available): AE, AG, AL, AM, 15/465,515 21 March 2017 (21.03.2017) US AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, _ (54) Title: KERNEL-BASED DETECTION OF TARGET APPLICATION FUNCTIONALITY USING OFFSET-BASED VIRTUAL ADDRESS MAPPING = = 100 / = = MEMORY 104 = VIRTUAL MACHINE 118 APPLICATION BINARY CODE 108 APPLICATION SOURCE CODE 110 = = = CPU 102 = I = HIGH-LEVEL OPERATING SYSTEM (HLOS) 106 = REGISTERED APPLICATIONS 112 VIRTUAL ADDRESS- TO-FUNCTION = TRUSTED ZONE 114 MAPPING TABLE 120 = = MALICIOUS CODE DETECTION ALGORITHM(S) 116 IDENTIFIER-TO- VIRTUAL-ADDRESS FIG. 1 MAPPING TABLE 122 11 N (57) : Systems and methods are disclosed for detecting high-level functionality of an application executing on a computing N ` 14 device. One method comprises storing, in a secure memory, an application-specific virtual address mapping table for an application. N The application-specific virtual address mapping table has several virtual address offsets in the application binary code mapped to ei corresponding target application functionalities. In response to launching the application, a process-specific virtual address mapping 0 --.... table is generated for an instance of an application process to be executed. The process-specific virtual address mapping table defines GC actual virtual addresses corresponding to the target application functionalities using the virtual address offsets in the application-specific 1-1 c ::: :) virtual address mapping table. During execution of the application code, the method detects when one or more of the actual virtual N addresses corresponding to the target application functionalities are executed based on the process-specific virtual address mapping O [Continued on next page] WO 2018/022257 Al IMEDIMOMMIDIRDERIONEEHOHOMERVOE# KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Declarations under Rule 4.17: — as to applicant's entitlement to apply for and be granted a patent (Rule 4.17(ii)) — as to the applicant's entitlement to claim the priority of the earlier application (Rule 4.17(iii)) Published: — with international search report (Art. 21(3)) table.