SYSTEMS AND METHODS FOR DETERMINING AN ADDRESS FOR A PRIVATE FUNCTION

• US 20140122454A1
• Filed: 10/30/2012
• Published: 05/01/2014
• Est. Priority Date: 10/30/2012
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Appsense Incorporated
• Inventors: BRYLYN, David
• Granted Patent: US 9,141,613 B2
• Time in Patent Office: Days
• US Class Current: 707/705
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly

Abstract

Systems and methods are provided for determining an address for a private function. A start address for a public function of a software program in a data file associated with the software program is determined. Instruction data for the public function is identified in the data file based on the start address of the public function. First data of a predetermined size is read from a beginning of the instruction data for the public function. A signature for a private function of the software program is identified in the first data. A relative address for the private function in the data file based on the identified signature is stored in memory.

Claims

1. A computerized method for determining an address of a private function, the method comprising:

determining, by a computing device, a start address for a public function of a software program in a data file associated with the software program;

identifying, by the computing device, instruction data for the public function in the data file based on the start address of the public function;

reading, by the computing device, first data of a predetermined size from a beginning of the instruction data for the public function;

identifying, by the computing device, a signature for a private function of the software program in the first data; and

storing, by the computing device in memory, a relative address for the private function in the data file based on the identified signature.

2. The method of claim 1, further comprising:

receiving data indicative of the signature for the private function, wherein the signature is identified from assembly code associated with the software program; and

determining the predetermined size based on the signature.

3. The method of claim 1, wherein identifying comprises:

searching the first data for the signature of the private function;

determining the signature is not contained within the first data; and

searching the first data for end point data indicative of an end of the instruction data for the public function.

4. The method of claim 3, further comprising:

identifying the end point data within the first data; and

returning data indicative of the signature not being located in the instruction data of the public function.

5. The method of claim 3, further comprising:

determining the end point data is not contained within the first data; and

reading second data of the predetermined size from a next location of the instruction data in the data file.

6. The method of claim 1, wherein the public function is an exported function of the software program, and the private function is not an exported function of the software program but is instead an internal function of the software program.

7. The method of claim 1, further comprising:

intercepting a call of the private function by the software program; and

executing a custom function of a second software program in place of the private function.

8. The method of claim 7, further comprising determining the address of the private function after the second software program is compiled.

9. The method of claim 1, wherein determining the start address comprises determining the start address based on a table in the data file, wherein the table lists a set of public functions for the software program.

10. A server for determining an address of a private function, the server comprising:

a database; and

a processor in communication with the database, and configured to run a module stored in memory that is configured to cause the processor to;

determine a start address for a public function of a software program in a data file in the database associated with the software program;

identify instruction data for the public function in the data file based on the start address of the public function;

read first data of a predetermined size from a beginning of the instruction data for the public function;

identify a signature for a private function of the software program in the first data; and

store, in the memory, a relative address for the private function in the data file based on the identified signature.

11. A non-transitory computer readable medium having executable instructions operable to cause an apparatus to:

determine a start address for a public function of a software program in a data file associated with the software program;

identify instruction data for the public function in the data file based on the start address of the public function;

read first data of a predetermined size from a beginning of the instruction data for the public function;

identify a signature for a private function of the software program in the first data; and

store in memory a relative address for the private function in the data file based on the identified signature.

12. The non-transitory computer readable medium of claim 11, wherein the instructions are further operable to cause an apparatus to:

receiving data indicative of the signature for the private function, wherein the signature is identified from assembly code associated with the software program; and

determining the predetermined size based on the signature.

13. The non-transitory computer readable medium of claim 11, wherein the instructions are further operable to cause an apparatus to:

searching the first data for the signature of the private function;

determining the signature is not contained within the first data; and

searching the first data for end point data indicative of an end of the instruction data for the public function.

14. The non-transitory computer readable medium of claim 13, wherein the instructions are further operable to cause an apparatus to:

identifying the end point data within the first data; and

returning data indicative of the signature not being located in the instruction data of the public function.

15. The non-transitory computer readable medium of claim 13, wherein the instructions are further operable to cause an apparatus to:

determining the end point data is not contained within the first data; and

reading second data of the predetermined size from a next location of the instruction data in the data file.

16. The non-transitory computer readable medium of claim 11, wherein the public function is an exported function of the software program, and the private function is not an exported function of the software program but is instead an internal function of the software program.

17. The non-transitory computer readable medium of claim 11, wherein the instructions are further operable to cause an apparatus to:

intercepting a call of the private function by the software program; and

executing a custom function of a second software program in place of the private function.

18. The non-transitory computer readable medium of claim 11, further comprising determining the address of the private function after the second software program is compiled.

19. The non-transitory computer readable medium of claim 11, wherein determining the start address comprises determining the start address based on a table in the data file, wherein the table lists a set of public functions for the software program.