# US 2014/0196146 A1 · System, method and computer program product for inserting an emulation layer in association with a COM server DLL > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196146 A1 - Document ID: US20140196146A1 - Status: Published application - Kind: A1 - Application number: 11/484,088 - Filed: 2006-07-11 - Published: 2014-07-10 - Earliest claimed: 2006-07-11 - Assignees: McAfee, Inc. - Inventors: Ahmed Said Sallam - Web page: https://patentgrep.com/patent/US20140196146A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 1/32: Means for saving power - G06F 9/44521: {Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system, method and computer program product are provided. In use, a COM server dynamic link library is identified. Further, an emulation layer is inserted in association with the COM server dynamic link library to emulate interfaces exported by the COM server dynamic link library. As an option, it may be determined whether the COM server DLL is loaded, and the emulation layer may be inserted in response to the determination. ## Claims ### Claim 1 A method, comprising: identifying a COM server dynamic link library; inserting an emulation layer in association with the COM server dynamic link library to emulate interfaces exported by the COM server dynamic link library, utilizing a processor; identifying, utilizing the emulation layer, at least one infected COM server dynamic link library; and in response to the identifying the at least one infected COM server dynamic link library; retrieving an identifier associated with an application thread that loaded, prior to the inserting the emulation layer, the at least one infected COM server dynamic link library; and freeing, utilizing the emulation layer, the at least one infected COM server dynamic link library from memory based on the identifier. ### Claim 2 (depends on 1) The method of claim 1, and further comprising hooking predetermined functions. ### Claim 3 (depends on 2) The method of claim 2, wherein the predetermined functions include at least one of a ntdll!LdrLoadDll function and a ntdll!LdrGetProcedureAddress function. ### Claim 4 (depends on 1) The method of claim 1, and further comprising determining whether the COM server dynamic link library is loaded. ### Claim 5 (depends on 4) The method of claim 4, and further comprising intercepting at least one call associated with the COM server dynamic link library. ### Claim 6 (depends on 5) The method of claim 5, wherein the at least one call includes a DllGetClassObject call. ### Claim 7 (depends on 4) The method of claim 4, wherein the emulation layer is inserted in response to the determination. ### Claim 8 (depends on 1) The method of claim 1, wherein the emulation layer is inserted by replacing a first pointer with a proxy pointer pointing to a proxy interface. ### Claim 9 (canceled) ### Claim 10 (depends on 1) The method of claim 1, wherein the responding is carried out to counter terrorism. ### Claim 11 A computer program product embodied on a tangible non-transitory computer readable medium, comprising: computer code for identifying a COM server dynamic link library; computer code for inserting an emulation layer in association with the COM server dynamic link library to emulate interfaces exported by the COM server dynamic link library; computer code for identifying, utilizing the emulation layer, at least one infected COM server dynamic link library; and computer code for, in response to the identifying the at least one infected COM server dynamic link library: retrieving an identifier associated with an application thread that loaded, prior to the inserting the emulation layer, the at least one infected COM server dynamic link library; and freeing, utilizing the emulation layer, the at least one infected COM server dynamic link library from memory based on the identifier. ### Claim 12 (depends on 11) The computer program product of claim 11, and further comprising computer code for hooking predetermined functions. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the predetermined functions include at least one of a ntdll!LdrLoadDll function and a ntdll!LdrGetProcedureAddress function. ### Claim 14 (depends on 11) The computer program product of claim 11, and further comprising computer code for determining whether the COM server dynamic link library is loaded. ### Claim 15 (depends on 14) The computer program product of claim 14, and further comprising computer code for intercepting at least one call associated with the COM server dynamic link library. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the at least one call includes a DllGetClassObject call. ### Claim 17 (depends on 14) The computer program product of claim 14, wherein the emulation layer is inserted in response to the determination. ### Claim 18 (depends on 11) The computer program product of claim 11, wherein the emulation layer is inserted by replacing a first pointer with a proxy pointer pointing to a proxy interface. ### Claim 19 (canceled) ### Claim 20 A system, comprising: a processor for identifying a COM server dynamic link library, inserting an emulation layer in association with the COM server dynamic link library to emulate interfaces exported by the COM server dynamic link library, identifying, utilizing the emulation layer, at least one infected COM server dynamic link library; and in response to the identifying the at least one infected COM server dynamic link library: retrieving an identifier associated with an application thread that loaded, prior to the inserting the emulation layer, the at least one infected COM server dynamic link library; and freeing, utilizing the emulation layer, the at least one infected COM server dynamic link library from memory based on the identifier. ### Claim 21 (depends on 1) The method of claim 1, wherein inserting the emulation layer allows the COM server dynamic link library to be at least one of restricted and repaired without affecting an operation of COM client applications using the COM server. ### Claim 22 (depends on 1) The method of claim 1, wherein it is ascertained that there is no running application thread with a thread-function residing within the COM server dynamic link library prior to inserting the emulation layer.