System, method and computer program product for monitoring and/or analyzing at least one aspect of an invocation of an interface

• US 9,027,132 B2
• Filed: 09/30/2013
• Issued: 05/05/2015
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory William
• Primary Examiner(s): HERZOG, MADHURI R
• Application Number:
  US14/042,235
• Publication Number:
  US 20140059685A1
• Time in Patent Office: 582 Days
• Field of Search: 726 22- 25, 713187-188, 717124-161
• US Class Current: 726/22
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

A system, method and computer program product are provided. In use, execution of a portion of internal code of an interface is identified. Further, in response to the execution of the portion of internal code, at least one aspect of an invocation of the interface is monitored and/or analyzed.

Claims

1. A method, comprising:

identifying execution, by a hardware processor, of a portion of internal code of an interface, the portion of internal code located internal to the interface and logically after an entry point to the interface, the entry point representing a starting execution location of the interface;

in response to the execution of the portion of internal code, monitoring, by the hardware processor, at least one aspect of an invocation of the interface, wherein the monitoring is performed by a virtual machine to determine initiation of execution of the portion of internal code;

determining, by the hardware processor, whether the entry point was invoked prior to the execution of the portion of internal code; and

determining, by the hardware processor, whether the at least one aspect of the invocation of the interface is valid based upon whether the entry point was invoked prior to the execution of the portion of internal code.

2. The method as recited in claim 1, wherein the monitoring is performed utilizing an in-line hook.

3. The method as recited in claim 1, wherein:

at least one aspect of the invocation of the interface includes an invocation of an initial portion of the interface; and

the method further comprises;

determining whether the initial portion of the interface was invoked; and

identifying that the execution of the internal portion of the interface is potentially unwanted based on a determination that the initial portion of the interface was not invoked.

4. The method as recited in claim 1, wherein:

at least one aspect of the invocation of the interface includes an invocation of another portion of internal code of the interface;

the other portion of internal code includes a previous portion of internal code preceding the portion of internal code of the interface; and

the computer program product further comprises computer code for determining whether the other portion of internal code was invoked.

5. At least one non-transitory computer readable medium, comprising instructions executable by a processor, the instructions, when executed by the processor, configure the processor to:

identify execution of a portion of internal code of an interface, the portion of internal code located internal to the interface and logically after an entry point to the interface, the entry point representing a starting execution location of the interface;

monitor at least one aspect of an invocation of the interface, wherein the monitoring is performed by a virtual machine to determine initiation of execution of the portion of internal code;

determine whether the entry point was invoked prior to the execution of the portion of internal code; and

determine whether the at least one aspect of the invocation of the interface is valid based upon whether the entry point was invoked prior to the execution of the portion of internal code.

6. The medium as recited in claim 5, wherein the interface includes an application program interface.

7. The medium as recited in claim 5, wherein the internal code of the interface includes code subsequent to code utilized for executing an initial portion of the interface.

8. The medium as recited in claim 5, wherein the portion of internal code is predetermined.

9. The medium as recited in claim 5, wherein the portion of internal code is to be determined during runtime.

10. The medium as recited in claim 5, further comprising instructions for configuring the processor to validate the portion of internal code.

11. The medium as recited in claim 5, wherein the identifying execution of the portion of internal code includes identifying execution of a target address associated with the portion of internal code.

12. The medium as recited in claim 5, wherein at least one aspect of the invocation of the interface includes an invocation of an initial portion of the interface.

13. The medium as recited in claim 12, further comprising instructions for configuring the processor to determine whether the initial portion of the interface was invoked.

14. The medium as recited in claim 13, further comprising instructions for configuring the processor to identify the execution of the internal portion of the interface as potentially unwanted if it is determined that the initial portion of the interface was not invoked.

15. The medium as recited in claim 12, further comprising instructions for configuring the processor to validate the invocation of the initial portion of the interface.

16. The medium as recited in claim 5, wherein at least one aspect of the invocation of the interface includes an invocation of another portion of internal code of the interface.

17. The medium as recited in claim 16, wherein the other portion of internal code includes a previous portion of internal code preceding the portion of internal code of the interface.

18. The medium as recited in claim 16, further comprising instructions for configuring the processor to determine whether the other portion of internal code was invoked.

19. The medium as recited in claim 5, further comprising instructions for configuring the processor to identify the execution of the portion of internal code as potentially unwanted based on the monitoring at least one aspect of the invocation of the interface.

20. The medium as recited in claim 5, further comprising instructions for configuring the processor to perform at least one aspect of the monitoring with a callback function.

21. The medium as recited in claim 5, further comprising instructions for configuring the processor to perform the monitoring with an in-line hook.

22. A system, comprising:

at least one non-transitory computer readable medium;

a hardware processor communicatively coupled to the computer readable medium;

a callback module comprising instructions on the computer readable medium, the instructions, when read and executed by the processor, is configured to;

identify execution of a portion of internal code of an interface the portion of internal code located internal to the interface and logically after an entry point to the interface, the entry point representing a starting execution location of the interface;

monitor at least one aspect of an invocation of the interface, wherein the monitoring is performed by a virtual machine to determine initiation of the execution of the portion of internal code;

determine whether the entry point was invoked prior to the execution of the portion of internal code; and

determine whether the at least one aspect of the invocation of the interface is valid based upon whether the entry point was invoked prior to the execution of the portion of internal code.

23. The system as recited in claim 22, wherein:

at least one aspect of the invocation of the interface includes an invocation of an initial portion of the interface; and

the callback module is further configured to;

determine whether the initial portion of the interface was invoked; and

identify that the execution of the internal portion of the interface is potentially unwanted based on a determination that the initial portion of the interface was not invoked.

24. The system as recited in claim 22, wherein:

at least one aspect of the invocation of the interface includes an invocation of another portion of internal code of the interface;

the other portion of internal code includes a previous portion of internal code preceding the portion of internal code of the interface; and

the callback module is further configured to determine whether the other portion of internal code was invoked.

25. The system as recited in claim 22, wherein the monitoring is to be performed with an in-line hook.