Efficient patching

• US 8,539,469 B2
• Filed: 06/30/2004
• Issued: 09/17/2013
• Est. Priority Date: 05/11/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Blumfield, Anthony, Golan, Gilad, Garms, Jason, Alshibani, Saud, Field, Scott A.
• Primary Examiner(s): Dao, Thuy
• Assistant Examiner(s): Wang, Ben C
• Application Number:
  US10/880,848
• Publication Number:
  US 20050257208A1
• Time in Patent Office: 3,366 Days
• Field of Search: None
• US Class Current: 717/168
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/656 while running
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files

Abstract

A facility for applying a software patch is described. Using an automatic patching agent, the facility receives the software patch. In response to receiving the software patch, without user intervention, the facility performs the following acts: First, the facility identifies an instance of an executable module that is currently loaded, and to which the received software patch pertains. Second, the facility applies the received software patch to the identified loaded executable module instance to modify the behavior of the identified executable module instance.

Claims

1. A method in a computing system having a processor, non-volatile memory, and volatile memory, the method for applying a software patch to multiple instances of an executable module, the method comprising, using an automated patching agent:

receiving the software patch;

in response to receiving the software patch, without user intervention;

detecting, by the computing system, a first loading that has transferred a first instance of an executable module to which the received software patch pertains from the non-volatile memory to the volatile memory;

in response to the detection of the first loading, applying, by the computing system, the received software patch to the first instance of the executable module in volatile memory to modify a portion of the first instance of the executable module, such that the behavior of the first instance of the executable module is modified;

detecting, by the computing system, a second loading that has transferred a second instance of the executable module from the non-volatile memory to the volatile memory; and

in response to the detection of the second loading, applying, by the computing system, the received software patch to the second instance of the executable module in volatile memory to modify a portion of the second instance of the executable module, such that the behavior of the second instance of the executable module is modified.

2. The method of claim 1, wherein the executable module is an independently-executable module.

3. The method of claim 1, wherein the executable module is a library.

4. The method of claim 1, wherein the executable module is a script.

5. The method of claim 1, wherein the executable module is a managed code module.

6. The method of claim 1, wherein two software patches are received pertaining to the same executable module, and both received software patches are applied to modify the behavior of the first instance of the executable module.

7. The method of claim 6, wherein the two received patches pertain to different locations in the first instance of the executable module.

8. The method of claim 6, wherein the two received patches pertain to the same locations in the first instance of the executable module.

9. The method of claim 8, wherein the received patches are applied such that both behavior modifications specified by the patches are exhibited by the patched first instance of the executable module.

10. The method of claim 8, wherein the received patches are applied such that only the behavior modification of a dominant one of the two received software patches is exhibited by the first instance of the executable module.

11. The method of claim 10, wherein the dominant received software patch contains an explicit indication that it is to dominate one or more other software patches.

12. The method of claim 1, wherein the first instance of the executable module instance exhibits the modified behavior at a time after the received software patch is applied.

13. The method of claim 1, further comprising, using the automated patching agent, applying the received software patch to a disk image for the executable module.

14. The method of claim 1 wherein the first instance of the executable module to which the software patch pertains is identified from among a plurality of executable module instances to which the software patch pertains, and wherein the received software patch is applied using module instance-specific information for the first instance of the executable module contained in the received patch.

15. The method of claim 14 wherein the plurality of executable module instances are each a different version of the same executable module.

16. The method of claim 14 wherein the module instance-specific information for the first instance of the executable module contained in the received patch specifies an offset within the first instance of the executable module at which to modify the behavior of the first instance of the executable module.

17. The method of claim 16 wherein the module instance-specific information for the first instance of the executable module contained in the received patch further specifies content of the first instance of the executable module that is expected to appear at a specified offset before the received software patch is applied.

18. The method of claim 1 wherein the received software patch contains code specifying how to modify the behavior of the first instance of the executable module.

19. The method of claim 1 wherein the received software patch contains data specifying how to modify the behavior of the first instance of the executable module.

20. The method of claim 1 wherein the received software patch specifies modifying the behavior of the first instance of the executable module to add a test and test results-handling logic to a designated portion of the first instance of the executable module.

21. The method of claim 1 wherein the received software patch specifies modifying the behavior of the first instance of the executable module to add parameter validation functionality to a designated function within the first instance of the executable module.

22. The method of claim 1 wherein the received software patch specifies modifying the behavior of the first instance of the executable module to add parameter validation functionality to a designated function within the first instance of the executable module by identifying a standard parameter validation function that is to be called as part of the execution of the designated function.

23. The method of claim 1 wherein the modified behavior of the first instance of the executable module may be enabled or disabled using a patch configuration interface.

24. The method of claim 1 wherein logging of the modified behavior of the first instance of the executable module may be enabled or disabled using a patch configuration interface.

25. The method of claim 1 where the software patch is received by permitting the software patch to be copied to a predetermined location, and wherein the identifying and applying is performed automatically in response to the software patch being copied to the predetermined location.

26. A computer-readable storage memory whose contents cause a computing system having non-volatile memory and volatile memory to perform a method for applying a software patch to a currently-loaded executable module instance, comprising, using an automated patching agent:

receiving the software patch;

in response to receiving the software patch;

detecting, by the computing system, a first loading that has transferred a first instance of an executable module to which the received software patch pertains from the non-volatile memory to the volatile memory;

in response to the detection of the first loading, applying, by the computing system, the received software patch to the first instance of the executable module in volatile memory to modify a portion of the first instance of the executable module, such that the behavior of the first instance of the executable module is modified;

detecting, by the computing system, a second loading that has transferred a second instance of the executable module from the non-volatile memory to the volatile memory; and

in response to the detection of the second loading, applying, by the computing system, the received software patch to the second instance of the executable module in volatile memory to modify a portion of the second instance of the executable module, such that the behavior of the second instance of the executable module is modified.

27. A computing system for applying a software patch to a currently-loaded executable module instance, comprising:

a network interface that automatically receives the software patch, the software patch comprising a signature demonstrating that the software patch was produced by a designated patch authority, and that the software patch has not been modified since the signature was generated;

non-volatile memory;

volatile memory; and

a processor, in turn comprising;

a detection subsystem that, in response to receipt of the software patch by the network interface, without user intervention, detects a loading that has transferred an instance of an executable module to which the received software patch pertains from the non-volatile memory to the volatile memory; and

a patch application subsystem that, in response to detection of the loading of the instance of the executable module to which the received software patch pertains by the detection subsystem, without user intervention, applies the received software patch to the instance of the executable module in volatile memory to modify a portion of the instance of the executable module, such that the behavior of the instance of the executable module is modified.

28. A computer-readable storage memory containing a software patch data structure representing a software patch, the software patch data structure comprising;

first information identifying one or more executable software modules to which the patch is to be applied; and

second information specifying a manner in which the identified executable software modules are to be modified,

such that the contents of the software patch data structure are useable by an automatic patching agent to detect a first loading that has transferred the executable software module identified by the first information from a non-volatile memory of a computing system into a volatile memory of the computing system as a first instance, and in response to the detection of the first loading, modify a portion of the first instance of the executable software module in volatile memory in the manner specified by the second information, and

such that the contents of the software patch data structure are useable by an automatic patching agent to detect a second loading that has transferred the executable software module identified by the first information from a non-volatile memory of a computing system into a volatile memory of the computing system as a second instance, and in response to the detection of the second loading, modify a portion of the second instance of the executable software module in volatile memory in the manner specified by the second information.

29. The computer-readable storage memory of claim 28 wherein the second information is code specifying a manner in which the identified executable software modules are to be modified.

30. The computer-readable storage memory of claim 28 wherein the second information is data describing a manner in which the identified executable software modules are to be modified.

31. The computer-readable storage memory of claim 28 wherein the software patch data structure further comprises a signature demonstrating that the software patch data structure was produced by a designated patch authority, and that it has not been modified since the signature was generated.

32. The computer-readable storage memory of claim 31 wherein a signer identity can be discerned from the signature of the software patch data structure, and the discerned signer identity can be compared to a signer identity that can be discerned from a signature of the identified executable software module.