Dynamic run-time verification of a module which is loaded in memory (in
whole or in part) for execution is enabled by using pre-computed
portion-level verification data for portions of the module smaller than
the whole (e.g. at the page-level). A portion of the module as loaded
into memory for execution can be verified. Pre-computed portion-level
verification data is retrieved from storage and used to verify the loaded
portions of the executable. Verification data may be, for example, a
digitally signed hash of the portion. Where the operating system loader
has modified the portion for execution, the modifications are reversed,
removing any changes performed by the operating system. If the portion
has not been tampered, this will return the portion to its original
pre-loaded state. This version is then used to determine validity using
the pre-computed portion-level verification. Additionally, during
execution of the module, new portions/pages of the module which are
loaded can be verified to ensure that they have not been changed, and a
list of hot pages of the module can be made, including pages to be
continually reverified, in order to ensure that no malicious changes have
been made in the module.