Patent ID: 8479295

Claim:
A method, comprising: storing, by a processor, at least a portion of an executable application program in a host system physical memory at a first host physical address; instrumenting, by the processor, a copy of said portion of said executable application program and storing said instrumented copy in said host system physical memory at a second host physical address; setting, by the processor, a corresponding access permission to read only for said first host physical address and setting a corresponding access permission to execute only for said second host physical address; executing, by the processor, said instrumented copy or reading said portion of said executable application program based, at least in part, on said access permissions; generating, by the processor, a first extended page table associated with said first host physical address and a second extended page table associated with said second host physical address; and instrumenting, by the processor, a memory scanner with a first instruction, said first instruction configured to select said first extended page table, wherein said memory scanner is configured to read said portion of said executable application program and said first instruction is configured to be executed prior to said memory scanner reading said portion of said executable application program.