Changing code execution path using kernel mode redirection

Details Changing code execution path using kernel mode redirection Changing code execution path using kernel mode redirection

2008-05-27

2008-05-27

Moazzami, Nasser (Department: 2136)

Information security

Access control or authentication

C726S002000, C726S022000, C726S026000

Reexamination Certificate

active

07380269

ABSTRACT:
A mechanism for redirecting a code execution path in a running process. A one-byte interrupt instruction (e.g., INT 3) is inserted into the code path. The interrupt instruction passes control to a kernel handler, which after executing a replacement function, returns to continue executing the process. The replacement function resides in a memory space that is accessible to the kernel handler. The redirection mechanism may be applied without requiring a reboot of the computing device on which the running process is executing. In addition, the redirection mechanism may be applied without overwriting more than one byte in the original code.

REFERENCES:
patent: 5339426 (1994-08-01), Aoshima
patent: 6959441 (2005-10-01), Moore
patent: 7117285 (2006-10-01), Ota
patent: 2002/0019887 (2002-02-01), Moore
patent: 2005/0060462 (2005-03-01), Ota
U.S. Appl. No. 11/273,775, filed Nov. 14, 2005, Lelikov et al.

Affiliated with

Also associated with

Rating

Changing code execution path using kernel mode redirection does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Changing code execution path using kernel mode redirection, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Changing code execution path using kernel mode redirection will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-2814079