# US 12,223,040 B2 · Blocking routine redirection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,040 B2 - Document ID: US12223040B2 - Status: Granted - Kind: B2 - Application number: 17/240,418 - Filed: 2021-04-26 - Published: 2021-10-14 - Granted: 2025-02-11 - Earliest claimed: 2015-07-24 - Applicants: Citrix Systems, Inc. - Inventors: David Linde - Web page: https://patentgrep.com/patent/US12223040B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 21/305: {by remotely controlling device operation} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 2221/033: Test or assess software - G06F 2221/2123: Dummy operation - G06F 2221/2143: Clearing memory, e.g. to prevent the data from being stolen - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed herein are methods, systems, and computer-readable media for blocking attempts at runtime redirection and attempts to change memory permissions during runtime. The present disclosure describes features that enable runtime detection of an attempt to redirect routines or change memory permissions, and determining whether to allow or deny the attempt. Such features may include changing memory write permissions on memory segments, such as those segments used by dynamic loaders after call associations have been saved or otherwise created. Other features may include swapping the addresses of system routines (e.g., open, read, write, close, etc.) to new routines that perform the same function as well as additional functionality configured to detect attempts to redirect or change memory permissions. Once detected by the new routine during runtime, a determination may be made to deny or allow the call based on a policy. ## Claims ### Claim 1 A method comprising: enabling detection of a redirection of data being attempted by a call by changing one or more memory permissions of a virtual file system, the call including at least one change to a memory permission of the virtual file system; detecting, by use of executable code that is executed in response to the call being received, that the call is attempting to redirect data based on an attempt to perform the at least one change to the memory permission of the file system; and denying the at least one change to the memory permission of the file system; wherein enabling detection of the redirection comprises: identifying one or more first system routines that read or write memory permissions associated with the virtual file system; identifying one or more memory locations of the one or more first system routines; and exchanging the one or more memory locations with one or more memory locations of one or more second routines, wherein respective ones of the second routines each comprise code that performs the functions of respective ones of the first routines and additional code that detects the redirection of the data. ### Claim 2 (depends on 1) The method of claim 1, wherein the redirection of data comprises a redirection from one or more file system operations. ### Claim 3 (depends on 1) The method of claim 1 further comprising: establishing the executable code to be executed as pre-processing of a file system operation associated with the call. ### Claim 4 (depends on 1) The method of claim 1 further comprising: establishing the executable code to be executed as post-processing of a file system operation associated with the call. ### Claim 5 (depends on 1) The method of claim 1, wherein the file system comprises a virtual file system. ### Claim 6 (depends on 1) The method of claim 1, wherein the one or more memory permissions are for a segment of memory of the file system; and wherein detecting that the call is attempting to redirect data is performed based on content of the call being indicative of a memory address within the segment. ### Claim 7 (depends on 1) The method of claim 1, wherein denying the call is performed based on changing one or more parameters of the call. ### Claim 8 (depends on 1) The method of claim 1, wherein denying the call includes restoring one or more original values that were changed by the call. ### Claim 9 An apparatus comprising: one or more processors; and memory storing executable instructions that, when executed by the one or more processors, cause the apparatus to: enable detection of a redirection of data being attempted by a call by changing one or more memory permissions of a file system, the call including at least one change to a memory permission of the file system; detect, by use of executable code that is executed in response to the call being received, that the call is attempting to redirect data based on an attempt to perform the at least one change to the memory permission of the file system; and deny the at least one change to the memory permission of the file system; wherein the instructions that cause the apparatus to enable detection of the redirection comprise instructions for: identifying one or more first system routines that read or write memory permissions associated with the virtual file system; identifying one or more memory locations of the one or more first system routines; and exchanging the one or more memory locations with one or more memory locations of one or more second routines, wherein respective ones of the second routines each comprise code that performs the functions of respective ones of the first routines and additional code that detects the redirection of the data. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the redirection of data comprises a redirection from one or more file system operations. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the file system comprises a virtual file system. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the one or more memory permissions are for a segment of memory of the file system; and wherein the executable instructions, when executed, cause the apparatus to detect that the call is attempting to redirect based on content of the call being indicative of a memory address within the segment. ### Claim 13 (depends on 9) The apparatus of claim 9, wherein the executable instructions, when executed, cause the apparatus to deny the call based on changing one or more parameters of the call. ### Claim 14 (depends on 9) The apparatus of claim 9, wherein the executable instructions, when executed, cause the apparatus to deny the call by at least restoring one or more original values that were changed by the call. ### Claim 15 One or more non-transitory computer-readable media storing executable instructions that, when executed, cause an apparatus to: enable detection of a redirection of data being attempted by a call by changing one or more memory permissions of a file system, the call including at least one change to a memory permission of the file system; detect, by use of executable code that is executed in response to the call being received, that the call is attempting to redirect data based on an attempt to perform the at least one change to the memory permission of the file system; and deny the at least one change to the memory permission of the file system; wherein the instructions that cause the apparatus to enable detection of the redirection comprise instructions for: identifying one or more first system routines that read or write memory permissions associated with the virtual file system; identifying one or more memory locations of the one or more first system routines; and exchanging the one or more memory locations with one or more memory locations of one or more second routines, wherein respective ones of the second routines each comprise code that performs the functions of respective ones of the first routines and additional code that detects the redirection of the data. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the redirection of data comprises a redirection from one or more file system operations. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the file system comprises a virtual file system. ### Claim 18 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the one or more memory permissions are for a segment of memory associated with the file system; and wherein the executable instructions, when executed, cause the apparatus to detect that the call is attempting to redirect based on content of the call being indicative of a memory address within the segment. ### Claim 19 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the executable instructions, when executed, cause the apparatus to deny the call based on changing one or more parameters of the call. ### Claim 20 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the executable instructions, when executed, cause the apparatus to deny the call by at least restoring one or more original values that were changed by the call.