System, method, and computer program product for terminating a hidden kernel process

• US 8,613,006 B2
• Filed: 12/15/2011
• Issued: 12/17/2013
• Est. Priority Date: 08/17/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sallam, Ahmed Said
• Primary Examiner(s): NGUYEN, VAN H
• Application Number:
  US13/326,333
• Publication Number:
  US 20120084799A1
• Time in Patent Office: 733 Days
• Field of Search: None
• US Class Current: 719/331
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 9/44594 Unloading
• CPC Class Codes: G06F 9/485 Task life-cycle, e.g. stopping, restarting, resuming execution G06F9/4881 takes precedence

Abstract

A system, method, and computer program product are provided for terminating a hidden kernel process. In use, a hidden kernel process structure associated with a hidden kernel process is identified. In addition, the hidden kernel process structure is inserted into an active process list. Further, the hidden kernel process is terminated.

Claims

1. A method, comprising:

inserting, by one or more processors, a hidden kernel process structure into an active process list by pointing a backward link of a pointer representing the active process list to a forward link of an active process links structure of the hidden kernel process structure;

synchronizing, by the one or more processors, memory operations to preserve state during the inserting of the hidden kernel process structure; and

terminating, by the one or more processors, a hidden kernel process associated with the hidden kernel process structure.

2. The method of claim 1, wherein synchronizing memory operations comprises acquiring a mutex prior to inserting the hidden kernel process structure into the active process list.

3. The method of claim 1, wherein inserting the hidden kernel process structure comprises modifying links of the active process list to append the hidden kernel process structure to the end of the active process list.

4. The method of claim 1, wherein inserting the hidden kernel process structure comprises pointing a forward link of an active process links structure of a current last kernel process structure to the active process links structure of the hidden kernel process.

5. The method of claim 1, wherein inserting the hidden kernel process structure comprises:

pointing a forward link of the hidden kernel process structure to a head of the active process list;

pointing a backward link of the hidden kernel process to a current last kernel process structure;

pointing a backward link of the head to the hidden kernel process structure; and

pointing a forward link of the current last kernel process structure to the hidden kernel process structure.

6. The method of claim 1, wherein terminating the hidden kernel process comprises removing the inserted hidden kernel process structure from the active process list.

7. The method of claim 1, wherein:

inserting the hidden kernel process structure comprises modifying links of the active process list to append the hidden kernel process structure to the end of the active process list; and

terminating the hidden kernel process comprises removing the inserted hidden kernel process structure from the active process list.

8. Non-transitory media that includes code for execution and when executed by one or more processors to perform operations comprising:

inserting, by the one or more processors, a hidden kernel process structure into an active process list by pointing a backward link of a pointer representing the active process list to a forward link of an active process links structure of the hidden kernel process structure;

synchronizing, by the one or more processors, memory operations to preserve state during the inserting of the hidden kernel process structure; and

terminating, by the one or more processors, a hidden kernel process associated with the hidden kernel process structure.

9. The media of claim 8, wherein synchronizing memory operations comprises acquiring a mutex prior to inserting the hidden kernel process structure into the active process list.

10. The media of claim 8, wherein inserting the hidden kernel process structure comprises modifying links of the active process list to append the hidden kernel process structure to the end of the active process list.

11. The media of claim 8, wherein inserting the hidden kernel process structure comprises pointing a forward link of an active process links structure of a current last kernel process structure to the active process links structure of the hidden kernel process.

12. The media of claim 8, wherein inserting the hidden kernel process structure comprises:

pointing a forward link of the hidden kernel process structure to a head of the active process list;

pointing a backward link of the hidden kernel process to a current last kernel process structure;

pointing a backward link of the head to the hidden kernel process structure; and

pointing a forward link of the current last kernel process structure to the hidden kernel process structure.

13. The media of claim 8, wherein terminating the hidden kernel process comprises removing the inserted hidden kernel process structure from the active process list.

14. The media of claim 8, wherein:

inserting the hidden kernel process structure comprises modifying links of the active process list to append the hidden kernel process structure to the end of the active process list; and

terminating the hidden kernel process comprises removing the inserted hidden kernel process structure from the active process list.

15. A system, comprising:

one or more processors to execute instructions such that the system is configured for;

inserting a hidden kernel process structure into an active process list by pointing a backward link of a pointer representing the active process list to a forward link of an active process links structure of the hidden kernel process structure;

synchronizing memory operations to preserve state during the inserting of the hidden kernel process structure; and

terminating a hidden kernel process associated with the hidden kernel process structure.

16. The system of claim 15, wherein synchronizing memory operations comprises acquiring a mutex prior to inserting the hidden kernel process structure into the active process list.

17. The system of claim 15, wherein inserting the hidden kernel process structure comprises modifying links of the active process list to append the hidden kernel process structure to the end of the active process list.

18. The system of claim 15, wherein inserting the hidden kernel process structure comprises pointing a forward link of an active process links structure of a current last kernel process structure to the active process links structure of the hidden kernel process.

19. The system of claim 15, wherein inserting the hidden kernel process structure comprises:

pointing a forward link of the hidden kernel process structure to a head of the active process list;

pointing a backward link of the hidden kernel process to a current last kernel process structure;

pointing a backward link of the head to the hidden kernel process structure; and

pointing a forward link of the current last kernel process structure to the hidden kernel process structure.

20. The system of claim 15, wherein terminating the hidden kernel process comprises removing the inserted hidden kernel process structure from the active process list.