Abstract: This disclosure addresses systems and methods for the protection of hardware and software in a computing environment. A hypervisor-monitor may be nested between the hardware of a host system and a hypervisor that is capable of supporting one or more guest virtual machines. The hypervisor-monitor may intercept exceptions generated by one or more processors in the host system and inspect software instructions for the hypervisor and the guests. Inspection may include performing a hash of the software instructions and a comparison of the hash with authorized software modules or a set of known malware. In this manner the hypervisor-monitor may monitor prevent the execution of malware by the hypervisor or the guests or provide a record of when code of an unknown origin was executed.

Abstract: Embodiments of a system and method for live computer forensics are generally described herein. The system can include a first hypervisor configured to halt a computer system, the computer system including a central processing unit, a drive, a volatile memory, and a non-volatile memory. The first hypervisor can be configured to collect data representative of the state of the computer system at the time the computer system was halted. The data representative of the state of the computer system can include the contents of the volatile and non-volatile memory at the time the computer system was halted, wherein at least a portion of the collected data is representative of the state of the central processing unit and the contents of the drive, at the time the computer system was halted.

Abstract: This disclosure addresses systems and methods for the protection of hardware and software in a computing environment. A hypervisor-monitor may be nested between the hardware of a host system and a hypervisor that is capable of supporting one or more guest virtual machines. The hypervisor-monitor may intercept exceptions generated by one or more processors in the host system and inspect software instructions for the hypervisor and the guests. Inspection may include performing a hash of the software instructions and a comparison of the hash with authorized software modules or a set of known malware. In this manner the hypervisor-monitor may monitor prevent the execution of malware by the hypervisor or the guests or provide a record of when code of an unknown origin was executed.