System, method, and computer program product for invoking an application program interface within an interception of another application program interface

• US 8,739,189 B2
• Filed: 01/24/2008
• Issued: 05/27/2014
• Est. Priority Date: 01/24/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory William
• Primary Examiner(s): Truong, Lechi
• Application Number:
  US12/019,514
• Publication Number:
  US 20130276002A1
• Time in Patent Office: 2,315 Days
• Field of Search: 719/332, 719/310, 719/328, 719/330, 707/206, 718/1
• US Class Current: 719/328
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 9/524 Deadlock detection or avoidance
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications

Abstract

A system, method, and computer program product are provided for invoking an application program interface within an interception of another application program interface. In use, a first application program interface invoked utilizing a first thread is intercepted. Further, a second application program interface is invoked within the interception of the first application program interface, utilizing a second thread.

Claims

1. A non-transitory computer readable storage medium storing instructions that when executed by a programmable processing device cause the programmable processing device to:

intercept a first application program interface invoked, utilizing a first thread, by a process executing on the programmable processing device, the first thread associated with an application program interface interception handler, the application program interception handler including a callback function, the programmable processing device secured via a security system; and

invoke a second application program interface within the interception of the first application program interface, utilizing a second thread, the second thread comprising a worker thread;

wherein invoking the second application program interface within the interception of the first application program interface includes invoking the second application program interface within a context of the application program interface interception handler.

2. The non-transitory computer readable storage medium of claim 1, wherein the instructions to cause the programmable processing device to invoke the first application program interface include instructions to cause the programmable processing device to call the first application program interface.

3. The non-transitory computer readable storage medium of claim 1, wherein the first application program interface invocation is intercepted in a user mode.

4. The non-transitory computer readable storage medium of claim 1, wherein the first application program interface invocation is intercepted in a kernel mode.

5. The non-transitory computer readable storage medium of claim 1, wherein the second application program interface includes the first application program interface.

6. The non-transitory computer readable storage medium of claim 1, wherein the second application program interface is different from the first application program interface.

7. The non-transitory computer readable storage medium of claim 1, wherein the worker thread is selected from a plurality of worker threads.

8. The non-transitory computer readable storage medium of claim 1, further comprising instructions to cause the programmable processing device to invoke a wrapper function.

9. The non-transitory computer readable storage medium of claim 8, wherein the wrapper function packages a request for the second application program interface to be invoked and transmits the packaged request to the second thread.

10. The non-transitory computer readable storage medium of claim 8, wherein the wrapper function provides a timeout condition for the second application program interface.

11. The non-transitory computer readable storage medium of claim 8, wherein the wrapper function retrieves results of the invocation of the second application program interface.

12. The non-transitory computer readable storage medium of claim 1, wherein invoking the second application program interface utilizing the second thread prevents the second application program interface from affecting the first thread.

13. A method, comprising:

intercepting a first application program interface invoked, utilizing a first thread, by a process executing on a programmable processing device, the first thread associated with an application program interface interception handler, the application program interception handler including a callback function, the programmable processing device secured via a security system; and

invoking a second application program interface within the interception of the first application program interface, utilizing a second thread, the second thread comprising a worker thread;

wherein invoking the second application program interface within the interception of the first application program interface includes invoking the second application program interface within a context of the application program interface interception handler.

14. A system, comprising:

a processor for intercepting a first application program interface invoked, utilizing a first thread, by a process executing on the processor, the processor secured via a security system and further adapted to invoke a second application program interface within the interception of the first application program interface, utilizing a second thread, the second thread comprising a worker thread;

wherein the first thread is associated with an application program interface interception handler,

wherein the application program interface interception handler includes a callback function, and

wherein invoking the second application program interface within the interception of the first application program interface includes invoking the second application program interface within a context of the application program interface interception handler.

15. The system of claim 14, wherein the processor is coupled to memory via a bus.