Method and apparatus for performing antivirus tasks in a mobile wireless device

• US 20060161985A1
• Filed: 05/10/2005
• Published: 07/20/2006
• Est. Priority Date: 01/14/2005
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Zhao, Xiaoming
• Granted Patent: US 7,735,138 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Disclosed are techniques for performing an antivirus task in a mobile wireless device running an embedded operating system. In one embodiment, calls intended for an application programming interface (API) function code is redirected to an antivirus function code. The redirection to the antivirus function code may be performed by modifying a kernel structure to point to a modified entry list instead of an API entry list. The redirection to the antivirus function code may also be performed by modifying the API function code to allow the antivirus function code to execute before the API function code. The kernel structure or the API function code may be properly restored back to its original form. Software implementations of these techniques may be readily loaded and unloaded, and may not require re-installation of the embedded operating system.

Claims

1. A method of performing an antivirus task in a mobile wireless device, the method comprising:

replacing a reference to an original entry list with a reference to a replacement entry list in a kernel data structure of an embedded operating system running in the mobile wireless device, the replacement entry list including a reference to an antivirus function code;

redirecting a call to an original function code to the antivirus function code by way of the replacement entry list;

performing an antivirus task with the antivirus function code; and

forwarding the call to the original function code after performing the antivirus task.

2. The method of claim 1 wherein the mobile wireless device comprises a mobile telephone.

3. The method of claim 1 wherein the call comprises function call for a file operation.

4. The method of claim 1 wherein the reference to the antivirus function code comprises a pointer to an entry point of the antivirus function code.

5. The method of claim 1 wherein the antivirus task includes scanning a file in the mobile wireless device for viruses.

6. The method of claim 1 wherein forwarding the call to the original function code after performing the antivirus task comprises performing a jump from the antivirus function code to an entry point of the original function code.

7. The method of claim 6 wherein the entry point of the original function code is referenced in the original entry list.

8. The method of claim 1 further comprising:

restoring the reference to the original entry list in the kernel after assuring that each call redirected to the antivirus function code has existed the antivirus function code.

9. The method of claim 8 wherein assuring that each call redirected to the antivirus function code has existed the antivirus function code comprises:

incrementing a counter when a call is redirected to the antivirus function code;

decrementing the counter when the call is forwarded to the original function code; and

assuring the counter is zero before restoring the reference to the original entry list.

10. A method of performing an antivirus task in a mobile wireless device, the method comprising:

replacing a first instruction in an original function code with a reference to an antivirus function code in a mobile wireless device running an embedded operating system;

creating a stub code comprising the first instruction from the original function code;

redirecting a call received by the original function code to the antivirus function code by way of the reference to the antivirus function code;

performing an antivirus task with the antivirus function code;

executing the first instruction in the stub code after performing the antivirus task; and

executing a second instruction in the stub code to execute a third instruction in the original function code.

11. The method of claim 10 wherein the reference to the antivirus function code in the original function code comprises an instruction loading an address of the antivirus function code in a program counter.

12. The method of claim 10 wherein the mobile wireless device comprises a mobile telephone.

13. The method of claim 10 wherein the antivirus task comprises scanning for viruses.

14. The method of claim 10 further comprising:

restoring the original function code to its previous form prior to replacing the first instruction in the original function code after assuring that each call redirected to the antivirus function code has existed the antivirus function code.

15. The method of claim 14 wherein assuring that each call redirected to the antivirus function code has existed the antivirus function code comprises:

incrementing a counter when a call is redirected to the antivirus function code;

decrementing the counter when the call is forwarded to the original function code; and

assuring the counter is zero before restoring the original function code to its previous form.

16. A mobile wireless device with antivirus software, the device comprising:

an embedded operating system;

computer-readable program code for redirecting a call intended to be performed by an original function code to an antivirus function code;

computer-readable program code for performing an antivirus task with the antivirus function code and forwarding the call to the original function code after the antivirus task has been performed; and

computer-readable program code fort stopping redirection to the antivirus function code after assuring that each call redirected to the antivirus function code has exited the antivirus function code.

17. The device of claim 16 wherein the mobile wireless device comprises a mobile telephone.

18. The device of claim 16 wherein the antivirus task comprises scanning for computer viruses in the device.

19. The device of claim 16 wherein the computer-readable program code for stopping redirection to the antivirus code comprises:

computer-readable program code for incrementing a global counter when the antivirus function code is entered;

computer-readable program code for decrementing the global counter when the antivirus function code is existed; and

computer-readable program code for assuring the global counter has a count of zero before stopping redirection to the antivirus function code.

20. The device of claim 16 wherein the embedded operating system comprises a windowing operating system.