Dynamic run-time
verification of a module which is loaded in memory (in whole or in part) for execution is enabled by using pre-computed portion-level
verification data for portions of the module smaller than the whole (e.g. at the page-level). A portion of the module as loaded into memory for execution can be verified. Pre-computed portion-level
verification data is retrieved from storage and used to verify the loaded portions of the
executable.
Verification data may be, for example, a digitally signed hash of the portion. Where the
operating system loader has modified the portion for execution, the modifications are reversed, removing any changes performed by the
operating system. If the portion has not been tampered, this will return the portion to its original pre-loaded state. This version is then used to determine validity using the pre-computed portion-level verification. Additionally, during execution of the module, new portions / pages of the module which are loaded can be verified to ensure that they have not been changed, and a
list of hot pages of the module can be made, including pages to be continually reverified, in order to ensure that no malicious changes have been made in the module.