Kernel-based detection of target application functionality using offset-based virtual address mapping

    公开(公告)号:US10360383B2

    公开(公告)日:2019-07-23

    申请号:US15465515

    申请日:2017-03-21

    Abstract: Systems and methods are disclosed for detecting high-level functionality of an application executing on a computing device. One method includes storing, in a secure memory, an application-specific virtual address mapping table for an application. The application-specific virtual address mapping table comprises a plurality of virtual address offsets in the application binary code mapped to corresponding target application functionalities. In response to launching the application, a process-specific virtual address mapping table is generated for an instance of an application process to be executed. The process-specific virtual address mapping table defines actual virtual addresses corresponding to the target application functionalities using the virtual address offsets in the application-specific virtual address mapping table. During execution of the application code, the method detects when one or more of the actual virtual addresses corresponding to the target application functionalities are executed based on the process-specific virtual address mapping table.

Patent Agency Ranking