Function modification in a write-protected operating system

Details Function modification in a write-protected operating system Function modification in a write-protected operating system

2000-03-08

2004-04-06

Radmanabhan, Mano (Department: 2188)

Electrical computers and digital data processing systems: input/

Interrupt processing

Processor status

C711S154000, C711S163000, C710S260000, C712S015000, C712S043000, C712S220000, C712S229000, C712S242000, C712S243000, C713S001000, C713S100000

Reexamination Certificate

active

06718414

ABSTRACT:

BACKGROUND
1. Field of the Invention
The present invention relates in general to operating systems, and in particular to a method and apparatus to modify a system function in a computer running a write-protected operating system.
2. Description of the Related Art
It is sometimes desirable to intercept calls to system functions and to modify the called functions before they execute. In a computer system where clients request files from a server, for example, it may be desirable to modify the sequence of instructions within a global file function (e.g. a function to open a file) in order to conduct automatic virus-scanning of a requested file before forwarding it to the client. In this case, the modification may direct the central processing unit (CPU) to perform a virus-scanning operation on the file before conditionally returning to execute the original function code (i.e. depending on whether a virus was detected). Methods of “hooking” target entry points in called functions and adding new code were disclosed by Cook in U.S. Pat. No. 5,257,381, “METHOD OF INTERCEPTING A GLOBAL FUNCTION OF A NETWORK OPERATING SYSTEM AND CALLING A MONITORING FUNCTION,” issued Oct. 26, 1993 and assigned to the assignee of this application.
Write-protected computer operating systems such as Windows 200™ (Microsoft Corp., Redmond, Wash.) and NetWare™ 5.1 (Novell, Inc., Provo, Utah) prevent modification of system functions that have been loaded into memory by write-protecting the areas of main memory in which the function codes are stored. An attempt by a process to use a method as disclosed by Cook with such a write-protected operating system may result in an exception, causing the offending process and possibly the entire operating system to terminate. For this reason, it has been impossible to perform modification of system functions in a computer running a write-protected operating system.


REFERENCES:
patent: 5257381 (1993-10-01), Cook
patent: 5960190 (1999-09-01), MacKenna
patent: 6363474 (2002-03-01), McCulley et al.
patent: 6487630 (2002-11-01), Bui
Microsoft Press computer Dictionary, Third Edition, p. 341.*
Microsoft Corporation, Microsoft Windows Device Development Kit (DDK) for Windows, version 3.1, http://support.microsoft.com/support/kb/articles/Q78/3/25.ASP, “Ring Protection Under Windows 3.1” Nov. 1, 1999, pp. 1-2.
Apple Computer, Inc. Inside Macintosh: Operating Systems Utilities/Chapter 8-Trap manager, http://gemma.apple.com/techpubs/mac/OSUtilities/OSUtilities-170.html, “About the Trap Manager”, Jul. 6, 1996, pp. 1-18.
Part II Systems Programming, http://www.online.ee/-andre/i80386/Chap4.html, “Chapter 4 Systems Arthitecture”, Mar. 7, 2000, pp. 1-5.
Chapter 6 Protection, http://www.online.ee/~andre/880386/Chap6.html, “Chapter 6 Protection”, Mar. 7, 2000, pp. 1-15.
Microsoft Corporation, http://leb.net.wine/WinDoc/msdn/sdk/platforms/doc/sdk/win32/func/src/f17 6.htm, “DIIEntryPoint”, 1997, pp. 1-3.
http://www.iecc.com/linker/linker10.html, “Dynamic Linking and Loading,” Jun. 15, 1999, pp. 1-14.
Sun Microsystems, Inc. Kempf et al, “Cross-Address Space Dynamic Linking”, The SMLI Technical Report Series, Sep. 1992, pp. 1-11.
Intel 80386 Programmer's Reference, http://www.online.ee/~andre/i80386/, “Intel 80386 Programmer's Reference”, p. 1.
http://www.online.ee/~andre/i80386/Figs/Fig.6.html, Fig. 6-1 Protection Field of Segment Descriptors, Mar. 7, 2000, pp. 1-6.
http://www.acm.uiuc.edu/sigops/roll your own/i386/regs.html, The Intel 32-bit Register Set, 32-Bit Register Set, Mar. 7, 2000, pp. 1-3.
http://www.cs.umd.edu/~saltz/cs412/combine.html, Intel x86: Paging, Mar. 7, 2000, p. 1.
http://www.sandpile.org/arch/crx/htm, “IA-32 Architecture Control Registers”, Mar. 7, 2000, p. 1.
http://www.cs.umd.edu/~saltz/cs412/lecture4/lect4.html, “Segment level Protection”, Mar. 7, 2000, pp. 1-5.
http://x86.ddj.com/articles/pmbasics/tspec a1 doc.htm, Robert Collins, “Protected Mode Basics” Mar. 6, 2000, pp. 1-12.
http://www scm.tees.ac.uk/users/a.clements/Excepts/Excepts.htm, “Exception Handling and Computer Security”, Mar., 2000 pp. 1-31.
http:/
ic.funet.fi/pub/cmb/pet/manuals/8296supplement/8296supplement.txt, “CBM 8296-Supplement to the 8032 Manual”, Mar. 6, 2000, pp. 1-6.

Affiliated with

Also associated with

Rating

Function modification in a write-protected operating system does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Function modification in a write-protected operating system, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Function modification in a write-protected operating system will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3220244