Patent ID: 7577848

Claim:
A computer-implemented method having instructions executable by a processor, comprising: generating multiple partial image hashes by the processor of a computing device, wherein the multiple partial image hashes represent an executable file, each partial hash of the multiple partial image hashes representing an arbitrary number of bytes that is less than all of the bytes of the executable file; associating the executable file with corresponding partial image hashes on the computing device, wherein the corresponding partial image hashes are encapsulated into a system catalog by utilizing a make or update system catalog application to package the executable file and the corresponding partial image hashes into the system catalog, wherein the system catalog is a part of an operating system and the system catalog is implemented in a nonconventional system catalog, wherein the nonconventional system catalog comprises partial image hashes of an executable file; intercepting a file open request from a memory manager to open the executable file; locating one or more partial image hashes associated with the executable file and mapping one or more associated partial image hashes into a memory of the computing device, wherein the one or more associated partial image hashes are located after computing a hash of a header of the executable file and comparing a computed hash of the header with corresponding partial image hashes stored in the system catalog, determining that the executable file is represented in the system catalog; intercepting a request to page a portion of the executable file into the memory for execution subsequent to loading the executable file, wherein the portion of the executable file indicates an arbitrary number of bytes corresponding to a particular code-to-memory loading operation being performed; and responsive to intercepting the request, and prior to paging the portion of the executable file into memory for execution: computing a validation hash of the portion of the executable file; and comparing the validation hash of the portion of the executable file to a partial hash of the multiple partial image hashes to determine a code integrity of the portion of the executable file, the partial hash representing a same code segment as the portion of the executable file.