Direct process access

• US 7,814,549 B2
• Filed: 08/04/2006
• Issued: 10/12/2010
• Est. Priority Date: 08/03/2006
• Status: Expired due to Fees

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Park, Seung Bae
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): POLTORAK, PIOTR
• Application Number:
  US11/499,463
• Publication Number:
  US 20080046977A1
• Time in Patent Office: 1,530 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A method, computer program product and system for obtaining notification information about the state of an operating system. The method includes the steps of receiving, by a Direct Process Access (DPA) engine, a request for the notification information from a requesting program. The notification information is obtained from a database associated with the DPA engine and the notification information is provided to the requesting program. The DPA engine receives update information indicative of changes in the notification information directly from the operating system and causes the notification information to be updated in the database.

Claims

1. A method of obtaining notification information about the state of an operating system, the method comprising the steps of:

(1) receiving, by a Direct Process Access (DPA) engine, a request for the notification information from a requesting program;

(2) obtaining the notification information from a database associated with the DPA engine, wherein the notification information is stored in the database as two or more hash tables; and

,

(3) providing the notification information to the requesting program;

wherein, the DPA engine receives update information indicative of changes in the notification information directly from the operating system and causes the notification information to be updated in the database.

2. The method as claimed in claim 1, wherein the notification information is a process and module list.

3. The method as claimed in claim 1, wherein the update information is indicative of a change in a process or a module.

4. The method as claimed in claim 3, wherein the change is one or more of:

process loading;

process unloading;

module loading;

module unloading;

process creation;

process deletion;

module creation; and

module deletion.

5. The method as claimed in claim 1, wherein the DPA engine is a kernel driver.

6. The method as claimed in claim 5, wherein the request is sent using a DeviceIoControl( ) Win32 API.

7. The method as claimed in claim 1, wherein the operating system provides the update information as including a process ID and a flag.

8. The method as claimed in claim 7, wherein the flag is indicative of at least one of:

process loading;

process unloading;

process creation; and

process deletion.

9. The method as claimed in claim 1, wherein the operating system provides the update information as including a module name and pathway and associated process ID if available.

10. The method as claimed in claim 1, wherein a first hash table is representative of processes currently running in the operating system, each process referenced by a process ID.

11. The method as claimed in claim 10, wherein a second hash table is representative of modules currently loaded in the operating system.

12. The method as claimed in claim 11, wherein contents of the first hash table and the second hash table are mapped.

13. The method as claimed in claim 1, wherein the requesting program is one or more of:

a scanning engine;

an application;

a security program; and

anti-malware software.

14. The method as claimed in claim 1, wherein the DPA engine has the same privilege level as the operating system.

15. A computer program product for obtaining notification information about the state of an operating system, the computer program product comprising a non-transitory computer-readable storage medium having instructions thereon, the instructions comprising:

(1) code programmed to receive, at a Direct Process Access (DPA) engine, a request for the notification information from a requesting program;

(2) code programmed to obtain the notification information from a database associated with the DPA engine, wherein the notification information is stored in the database as two or more hash tables; and

,

(3) code programmed to provide the notification information to the requesting program;

wherein, the DPA engine receives update information indicative of changes in the notification information directly from the operating system and causes the notification information to be updated in the database.

16. The computer program product as claimed in claim 15, wherein the DPA engine is a kernel driver.

17. A system for obtaining notification information about the state of an operating system, the system comprising:

(1) at least one memory to store a database; and

,

(2) a processor, in communication with the at least one memory, the processor configured to;

(a) receive a request for the notification information from a requesting program;

(b) obtain the notification information from the database, wherein the notification information is stored in the database as two or more hash tables; and

,

(c) provide the notification information to the requesting program;

wherein, the processor receives update information indicative of changes in the notification information directly from the operating system and causes the notification information to be updated in the database.

18. The system as claimed in claim 17, wherein the operating system provides the update information as including a process ID and a flag.

19. The system as claimed in claim 18, wherein the flag is indicative of at least one of:

process loading;

process unloading;

process creation; and

process deletion.