Patent ID: 8850574

Claim:
A system comprising: one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to implement an extended Software Fault Isolation (SFI) software sandboxing system configured to perform operations comprising: providing a user-mode program interface operable to receive runtime requests to modify an executable memory region of a trusted sandbox, wherein the requests comprise requests to perform dynamic code creation; and for each runtime request to perform dynamic code creation: receiving new machine code and a code installation target address, verifying that the target address is in the executable memory region of the trusted sandbox, copying the new machine code to private memory located outside of the trusted sandbox, validating the new machine code in the private memory location, determining a target address range within which the new machine code will be installed, performing an operation on the target address range to verify that the target address range is currently unused memory and to reserve the target address range for installation of the new machine code, and copying the validated new machine code to the target address.