Method for function capture and maintaining parameter stack
AssigneeKaspersky Lab ZAO
InventorALEXANDER LEDENEV
Life of this patent
Estimating the term…
Abstract
A system and method for capturing and re-calling an application function. The method of function re-call during anti-virus check includes the following steps: function intercept (capture); anti-virus analysis of the parameters used to call the function; preparing of an application stack for function re-call (when the analysis did not detect any malicious functionality); and calling the function again. The exemplary method can be used with browsers and other applications.
Claims14
A computer-implemented method for intercepting and re-calling an application function, the method comprising:
- launching an application executing at least one function having at least one parameter;
- starting an interceptor module;
- intercepting the function using the interceptor module;
- acquiring function parameters and storing the function parameters in a stack;
- passing the function parameters to an analyzer;
- analyzing the function parameters for malware;
- terminating the application, when the malware is detected by the analyzer;
- and
- preparing a parameter stack and re-calling the function, when malware is not detected, and calling the function again with the parameters stored in the stack, where an initial function return address is stored in the stack at an address following a current stack pointer.
A system for intercepting and re-calling an application function, the system comprising:
- a processor;
- a memory coupled to the processor;
- a computer program logic stored in the memory and executed on the processor, the computer program logic is configured to implement the steps of:
- launching an application executing at least one function having at least one parameter;
- starting an interceptor module;
- intercepting the function using the interceptor module;
- acquiring function parameters and storing the function parameters in a stack;
- passing the function parameters to an analyzer;
- analyzing the function parameters for malware;
- terminating the application, when the malware is detected by the analyzer;
- and
- preparing a parameter stack and re-calling the function, when malware is not detected, and calling the function again with the parameters stored in the stack, where an initial function return address is stored in the stack at an address following a current stack pointer.
Dependencies are inferred from the claim text.