Preventing execution of malicious instructions based on address specified in a branch instruction

Abstract

In one aspect of the embodiments, malicious instructions executed or to be executed by a processor in a computing device are identified and preventive action is taken in response to that detection, thereby preventing harm to the computing device and the user's data by the malicious instructions. In another aspect of the embodiments, a thread context monitor determines which thread are active within an operating system at any given time, which further enhances the ability to determine which thread contains malicious instructions.

1 . A method of identifying valid addresses in a memory device that are referenced in BRANCH instructions to be executed by a processor coupled to the memory device, the method comprising:
 identifying an address referenced by a BRANCH instruction stored in a memory device;   adding the address to a data structure containing a list of valid addresses in the memory device if the address is assigned to a known software module; and   refraining from adding the address to the data structure if the address is not assigned to a known software module.   
     
     
         2 . The method of  claim 1 , wherein an address not assigned to a known software module is an unassigned address. 
     
     
         3 . The method of  claim 1 , wherein the address is determined to be assigned to a known software module if the address is located with an address range for binary executable files. 
     
     
         4 . The method of  claim 1 , wherein the data structure is a bloom filter data structure. 
     
     
         5 . The method of  claim 1 , wherein the data structure is a sorted list. 
     
     
         6 . The method of  claim 1 , wherein the data structure is a hashtable data structure. 
     
     
         7 . A method of maintaining a thread context within an operating system running on a computer system and controlling a malware prevention module, the computer system comprising a processor coupled to a memory device and the operating system comprising an asynchronous procedure call (APC) module and a thread context monitor, the method comprising:
 running one or more threads within the operating system;   maintaining, for each of the one or more threads, information within the APC module that indicates one or more start events for each thread;   deducing stop events for each thread based on start events of other threads;   maintaining a data structure, by the thread context monitor, comprising start event information and stop event information for each thread; and   turning a malware prevention module on or off based on the start event information and the stop event information in the data structure.   
     
     
         8 . The method of  claim 7 , wherein the data structure comprises a table that indicates the status for each of the one or more threads. 
     
     
         9 . A computer system comprising:
 a processor;   a memory device coupled to the processor; and   an operating system running within the processor, the operating system comprising an asynchronous procedure call (APC) module and a thread context monitor;   a malware prevention module running with the processor;   wherein the operating system runs one or more threads and the APC module maintains for each of the one or more threads information indicating one or more start events for each thread and the thread context monitor deduces stop events for each thread based on start events of other threads and maintains a data structure comprising start event information and stop event information for each thread; and   wherein the malware prevention module is turned on or off based on the start event information and the stop event information in the data structure.   
     
     
         10 . The computer system of  claim 9 , wherein the data structure comprises a table that indicates the status for each of the one or more threads.