SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR INVOKING AN APPLICATION PROGRAM INTERFACE WITHIN AN INTERCEPTION OF ANOTHER APPLICATION PROGRAM INTERFACE

• US 20130276002A1
• Filed: 01/24/2008
• Published: 10/17/2013
• Est. Priority Date: 01/24/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory William
• Granted Patent: US 8,739,189 B2
• Time in Patent Office: Days
• US Class Current: 719/328
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2201/865 Monitoring of software
• CPC Class Codes: G06F 9/524 Deadlock detection or avoidance
• CPC Class Codes: G06F 9/541 via adapters, e.g. between incompatible applications

Abstract

A system, method, and computer program product are provided for invoking an application program interface within an interception of another application program interface. In use, a first application program interface invoked utilizing a first thread is intercepted. Further, a second application program interface is invoked within the interception of the first application program interface, utilizing a second thread.

Claims

1. A computer program product embodied on a non-transitory computer readable storage medium, comprising:

computer code for intercepting a first application program interface invoked utilizing a first thread; and

computer code for invoking a second application program interface within the interception of the first application program interface, utilizing a second thread;

wherein the first thread is associated with an application program interface interception handler,

wherein the application program interface interception handler includes a callback function, and

wherein invoking the second application program interface within the interception of the first application program interface includes invoking the second application program interface within the context of the application program interface interception handler.

2. The computer program product of claim 1, wherein invoking the first application program interface includes calling the first application program interface.

3. The computer program product of claim 1, wherein the first application program interface is invoked by a process executing on a device secured via a security system.

4. The computer program product of claim 1, wherein the first application program interface invocation is intercepted in a user mode.

5. The computer program product of claim 1, wherein the first application program interface invocation is intercepted in a kernel mode.

9. The computer program product of claim 1, wherein the second application program interface includes the first application program interface.

10. The computer program product of claim 1, wherein the second application program interface is different from the first application program interface.

11. The computer program product of claim 1, wherein the second thread includes a worker thread.

12. The computer program product of claim 11, wherein the worker thread is selected from a plurality of worker threads.

13. The computer program product of claim 1, further comprising computer code for invoking a wrapper function.

14. The computer program product of claim 13, wherein the wrapper function packages a request for the second application program interface to be invoked and transmits the packaged request to the second thread.

15. The computer program product of claim 13, wherein the wrapper function provides a timeout condition for the second application program interface.

16. The computer program product of claim 13, wherein the wrapper function retrieves results of the invocation of the second application program interface.

17. The computer program product of claim 1, wherein invoking the second application program interface utilizing the second thread prevents the second application program interface from affecting the first thread.

6-8. -8. (canceled)

18. A method, comprising:

intercepting a first application program interface invoked utilizing a first thread; and

invoking a second application program interface within the interception of the first application program interface, utilizing a second thread;

wherein the first thread is associated with an application program interface interception handler,

wherein the application program interface interception handler includes a callback function, and

wherein invoking the second application program interface within the interception of the first application program interface includes invoking the second application program interface within the context of the application program interface interception handler.

19. A system, comprising:

a processor for intercepting a first application program interface invoked utilizing a first thread, the processor further adapted to invoke a second application program interface within the interception of the first application program interface, utilizing a second thread;

wherein the first thread is associated with an application program interface interception handler,

wherein the application program interface interception handler includes a callback function, and

wherein invoking the second application program interface within the interception of the first application program interface includes invoking the second application program interface within the context of the application program interface interception handler.

20. The system of claim 19, wherein the processor is coupled to memory via a bus.