Changing code execution path using kernel mode redirection
First Claim
1. A computer-implemented method of redirecting a code execution path in a running process, the code execution path including a plurality of instructions, the method comprising:
- modifying a kernel handler to upon being called by a first function, returning to an instruction in a replacement function that is separate from the first function;
overwriting a single one byte instruction in said code execution path with a one byte interrupt instruction while simultaneously leaving a remainder of instructions in the code execution path unaltered, whereupon execution of the one byte interrupt instruction in the running process causes the kernel handler to be called;
executing the replacement function called by said kernel handler; and
returning to said code execution path,wherein said method is performed without requiring a reboot of a computing device on which said running process is executing.
2 Assignments
0 Petitions
Accused Products
Abstract
A mechanism for redirecting a code execution path in a running process. A one-byte interrupt instruction (e.g., INT 3) is inserted into the code path. The interrupt instruction passes control to a kernel handler, which after executing a replacement function, returns to continue executing the process. The replacement function resides in a memory space that is accessible to the kernel handler. The redirection mechanism may be applied without requiring a reboot of the computing device on which the running process is executing. In addition, the redirection mechanism may be applied without overwriting more than one byte in the original code.
20 Citations
12 Claims
-
1. A computer-implemented method of redirecting a code execution path in a running process, the code execution path including a plurality of instructions, the method comprising:
-
modifying a kernel handler to upon being called by a first function, returning to an instruction in a replacement function that is separate from the first function; overwriting a single one byte instruction in said code execution path with a one byte interrupt instruction while simultaneously leaving a remainder of instructions in the code execution path unaltered, whereupon execution of the one byte interrupt instruction in the running process causes the kernel handler to be called; executing the replacement function called by said kernel handler; and returning to said code execution path, wherein said method is performed without requiring a reboot of a computing device on which said running process is executing. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A computer readable storage medium having computer executable instructions thereon for redirecting a code execution path in a running process, said computer executable instructions performing a method, comprising:
-
modifying a kernel handler to upon being called by a first function, returning to an instruction in a replacement function that is separate from the first function; overwriting a single one byte instruction in said code execution path with a one byte interrupt instruction while simultaneously leaving a remainder of instructions in the code execution path unaltered, whereupon execution of the one byte interrupt instruction in the running process causes the kernel handler to be called; executing the replacement function called by said kernel handler; and returning to said code execution path, wherein said method is performed without requiring a reboot of a computing device on which said running process is executing. - View Dependent Claims (9, 10, 11, 12)
-
Specification