Sergio V Rodriguez

US Patent:

20150379263, Dec 31, 2015

Filed:

Jun 27, 2014

Appl. No.:

14/318215

Inventors:

Harshawardhan Vipat - San Jose CA, US
Manohar R. Castelino - Santa Clara CA, US
Ravi L. Sahita - Beaverton OR, US
Sergio Rodriguez - San Lorenzo CA, US
Vikas Gupta - Santa Clara CA, US

International Classification:

G06F 21/56

Abstract:

Technologies for monitoring system API calls include a computing device with hardware virtualization support. The computing device establishes a default memory view and a security memory view to define physical memory maps and permissions. The computing device executes an application in the default memory view and executes a default inline hook in response to a call to an API function. The default inline hook switches to the security memory view using hardware support without causing a virtual machine exit. The security inline hook calls a security callback function to validate the API function call in the security memory view. Hook-skipping attacks may be prevented by padding the default inline hook with no-operation instructions, by designating memory pages of the API function as non-executable in the default memory view, or by designating memory pages of the application as non-executable in the security memory view. Other embodiments are described and claimed.

US Patent:

20140223429, Aug 7, 2014

Filed:

Dec 28, 2011

Appl. No.:

13/995245

Inventors:

Manohar R. Castelino - Sunnyvale CA, US
Vedvyas Shanbhogue - Austin TX, US
Sergio Rodriguez - San Lorenzo CA, US

International Classification:

G06F 9/455

US Classification:

718 1

Abstract:

Systems, methods, and computer program products that provide for the use of a type 2 VMM to de-link or isolate underlying processor hardware from an operating system. This may allow the launching of a task that requires direct access to processor hardware, where such access requires the absence of an operating system. Such a task may take the form of a type 1 VMM, such as an information security or integrity VMM, e.g., an anti-malware VMM.