Abstract: A tangible medium embodying instructions usable by a computer system to protect a plurality of guest virtual machines (VMs), which execute via virtualization software on a common host platform, from malicious code is described. A scan engine is configured to scan data for malicious code and determine a result of the scanning, wherein the result indicates whether malicious code is present in the data. A driver portion is configured for installation in an operating system of a target VM, which is one of the guest VMs. The driver portion intercepts an access request to a file, that originates within the target VM. The driver portion communicates information identifying a location of the data to be scanned by the scan engine without sending a copy of the data to the scan engine. The scan engine executes within the virtualization layer outside a context of the target VM.

Abstract: A computer implemented method for maintaining synchronization between a master computer disk and a clone disk that includes cloning the clone disk from the master computer disk, the clone disk having a customization portion; and customizing the customization portion with information relevant to a clone computer that uses the clone disk.

Abstract: An initiating subsystem transfers a data set either in or out in subsets such as packets. Packet transfer is sequential, and transfer of a packet is contingent upon successful transfer of a previous packet. Actual data transfer to or from a destination, over a channel, is handled by a host interface. When an intermediate subsystem, included as an interface between the initiating subsystem and host interface, senses that the initiating subsystem wants to transfer data, it receives a first packet from the initiating system. While continuing to indicate to the initiating system that transfer of the first packet is still pending, thereby causing the initiating system to suspend further packet submission, the intermediate subsystem sends to the host interface information concerning the entire data set to be transferred. When the entire data set is transferred, the intermediate subsystem emulates successful packet-wise transfer to the initiating subsystem.

Abstract: An agent loaded in a computer's operating system (OS) simulates disconnection and reconnection of a device, with no need to actually disconnect the device logically from a computer. During simulated reconnection, when the OS requests the hardware ID of the device, the agent returns a substitute ID, which causes the OS to load a substitute driver. Substitution of the ID also allows driver substitution for a not yet logically connected device; in this cases, no simulated disconnection or reconnection is needed. Driver substitution is dynamic and reversible, with no need to restart the system or reboot the OS and substitution of a driver for one device of a type does not disturb other devices of the same type. The invention may be implemented entirely in software, with no need for hardware modifications or device customization.

Abstract: The inventive emulator dynamically translates instructions in code written for a first architecture into code for a second architecture. The emulator designates various checkpoints in the original code, and speculatively reorders the placement of the translated code instructions according to optimization procedures. If during the execution of the reordered code, a trap should occur, then the emulator resets the original code to the most recent checkpoint and begins executing the original code sequentially in a line-by-line manner until the section is completed or branched out of. The original code is reset by changing the program counter to the checkpoint, and reversing the effects of each instruction which has been executed subsequent to the checkpoint.

Abstract: A method of executing a program compiled for a base instruction set architecture different than a native instruction set architecture, on a native machine by organizing a runtime system module into at least a low level domain, a medium level domain, and a high level domain. A memory buffer referred to as a backing store is created to correspond to a register stack and have a one-to-one mapping with the register stack. The invention initializes a beginning of the backing store to contain user-visible register values which constitute base instruction set architecture register values, and sets a virtual instruction pointer to a current instruction which is to be executed. The method of the present invention executes a start routine for forcing a reload of the user-visible register values from the backing store to the register stack and returns to the low level domain to perform a lookup operation in a translation lookaside buffer.

Abstract: A method of interpreting a program and performing time consuming operations at various times in a manner whereby the probability that a user of the program perceives any delay in the execution of the program is minimized. A time consuming operation as used herein is one which may take an interpreter from a fraction of a second to several seconds to perform, depending on the process. The method includes determining when a block will occur during the execution of the program. A block is a period of time that an operating system will halt a running of the program. Next it is determined whether or not to perform the time consuming operation based upon a criteria which depends on a length of time that the program is blocked. If it is blocked for a required time, the time consuming operation is performed, otherwise the interpreter will wait to perform the time consuming operation.

Abstract: An apparatus for translating a multiple user program into a native machine code to run on a native computer hardware having memory and an operating system that is capable of detecting whether the program has an instruction set architecture different from a native instruction set architecture. The memory has a source file including the program to be translated. At least one source code module is defined as including a plurality of blocks of code mapped to the memory by the operating system. The blocks have one or more source instructions, with each block beginning with one of the source instructions and ending with a branch or a target of the branch. A virtual instruction pointer points to one of the source instructions to be executed. One or more source instructions are dynamically translated and executed, and a profile data is produced. A shared translation file is ultimately created for the source code module using the profile data.