# US 2017/0286141 A1 · Capturing components of an application using a sandboxed environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2017/0286141 A1 - Document ID: US20170286141A1 - Status: Published application - Kind: A1 - Application number: 15/364,256 - Filed: 2016-11-29 - Published: 2017-10-05 - Earliest claimed: 2016-03-31 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Nir Adler; Dima Golbert; Avshi Avital - Web page: https://patentgrep.com/patent/US20170286141A1 ## CPC - G06F 9/45504: {Abstract machines for program code execution, e.g. Java virtual machine [JVM], interpreters or emulators} - G06F 8/61: Installation - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/4856: {resumption being on a different machine, e.g. task migration, virtual machine migration (G06F9/5088 takes precedence)} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 2009/45562: {Creating, deleting, cloning virtual machine instances} - G06F 2221/2101: Auditing as a secondary aspect - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A management agent operates transparently in the background on each endpoint computing device that needs to be managed. The agent sets up a sandboxed environment on the endpoint computing device on which it is operating in order to capture applications that have been installed on the endpoint device. The application capture is performed after the applications have been installed on the endpoint device and therefore does not require installing the application on any dedicated staging machine, nor any recording of the pre-installation state. The application capture process involves running the application from an isolated sandboxed environment on the computing device in order to identify all necessary components of the application by monitoring accesses by the application to components located outside of the sandbox. The identified components can then be packaged together and managed as individual application packages. ## Claims ### Claim 1 A method, comprising: identifying an installed application on a computing device for producing an application package corresponding to the application; locating an executable file of the application on the computing device and moving the executable file into a sandboxed environment in the computing device, the sandboxed environment configured to detect accesses made by code running inside the sandboxed environment to components located outside of the sandboxed environment; executing the executable file in the sandboxed environment; identifying a first component of the application by detecting, by the sandboxed environment, an access made by the executable file to the first component located outside of the sandboxed environment; moving the first component to the sandboxed environment; identifying a second component of the application located outside of the sandboxed environment by detecting, by the sandboxed environment, an access made by the executable file or by the first component to the second component located outside of the sandboxed environment; and creating the application package comprised of the executable file, the identified first component and the second component. ### Claim 2 (depends on 1) The method of claim 1, further comprising identifying further components of the application by detecting, by the sandboxed environment, accesses by the executable file or components located inside the sandboxed environment to the further components located outside of the sandboxed environment, wherein the created application package further comprises the further components. ### Claim 3 (depends on 1) The method of claim 1, wherein the computing device is one of a plurality of computing devices located on an enterprise network, the plurality of computing devices being centrally managed by a remote server over the network, wherein the application package is managed by the remote server. ### Claim 4 (depends on 3) The method of claim 3, wherein the locating the executable file of the application on the computing device and moving the executable file into a sandboxed environment in the computing device is performed in the background by an application management agent running on the computing device. ### Claim 5 (depends on 1) The method of claim 1, wherein the running the application inside the sandboxed environment is performed when a user of the computing device opens the application to use the application. ### Claim 6 (depends on 2) The method of claim 2, where the process of identifying further components of the application is terminated upon detection of a triggering event. ### Claim 7 (depends on 6) The method of claim 6, wherein a triggering event occurs when one of: the application stops running; a predetermined amount of time passes after the application starts running; or the number of accesses by code running inside the sandbox environment decreases by a predetermined metric. ### Claim 8 A computing device, comprising: at least one processor; and memory including instructions that, when executed by the at least one processor, cause the computing device to perform the steps of: identifying an installed application on a computing device for producing an application package corresponding to the application; locating an executable file of the application on the computing device and moving the executable file into a sandboxed environment in the computing device, the sandboxed environment configured to detect accesses made by code running inside the sandboxed environment to components located outside of the sandboxed environment; executing the executable file in the sandboxed environment; identifying a first component of the application by detecting, by the sandboxed environment, an access made by the executable file to the first component located outside of the sandboxed environment; moving the first component to the sandboxed environment; identifying a second component of the application located outside of the sandboxed environment by detecting, by the sandboxed environment, an access made by the executable file or by the first component to the second component located outside of the sandboxed environment; and creating the application package comprised of the executable file, the identified first component and the second component. ### Claim 9 (depends on 8) The computing device of claim 8, wherein the memory further includes instructions that when executed by the at least one processor, cause the computing device to perform the steps of: identifying further components of the application by detecting, by the sandboxed environment, accesses by the executable file or components located inside the sandboxed environment to the further components located outside of the sandboxed environment, wherein the created application package further comprises the further components. ### Claim 10 (depends on 8) The computing device of claim 8, wherein the computing device is one of a plurality of computing devices located on an enterprise network, the plurality of computing devices being centrally managed by a remote server over the network, wherein the application package is managed by the remote server. ### Claim 11 (depends on 10) The computing device of claim 10, wherein the locating the executable file of the application on the computing device and moving the executable file into a sandboxed environment in the computing device is performed in the background by an application management agent running on the computing device. ### Claim 12 (depends on 8) The computing device of claim 8, wherein the executing the executable file inside the sandboxed environment is performed when a user of the computing device opens the application to use the application. ### Claim 13 (depends on 9) The computing device of claim 9, wherein the process of identifying further components of the application is terminated upon detection of a triggering event. ### Claim 14 (depends on 13) The computing device of claim 13, wherein a triggering event occurs when one of: the application stops running; a predetermined amount of time passes after the application starts running; or the number of accesses by code running inside the sandbox environment decreases by a predetermined metric. ### Claim 15 A non-transitory computer readable storage medium comprising one or more sequences of instructions, the instructions when executed by one or more processors causing the one or more processors to execute the operations of: identifying an installed application on a computing device for producing an application package corresponding to the application; locating an executable file of the application on the computing device and moving the executable file into a sandboxed environment in the computing device, the sandboxed environment configured to detect accesses made by code running inside the sandboxed environment to components located outside of the sandboxed environment; executing the executable file in the sandboxed environment; identifying a first component of the application by detecting, by the sandboxed environment, an access made by the executable file to the first component located outside of the sandboxed environment; moving the first component to the sandboxed environment; identifying a second component of the application located outside of the sandboxed environment by detecting, by the sandboxed environment, an access made by the executable file or by the first component to the second component located outside of the sandboxed environment; and creating the application package comprised of the executable file, the identified first component and the second component. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, further comprising instructions that when executed by the one or more processors cause the one or more processors to execute the operations of: identifying further components of the application by detecting, by the sandboxed environment, accesses by the executable file or components located inside the sandboxed environment to the further components located outside of the sandboxed environment, wherein the created application package further comprises the further components. ### Claim 17 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the computing device is one of a plurality of computing devices located on an enterprise network, the plurality of computing devices being centrally managed by a remote server over the network, wherein the application package is managed by the remote server. ### Claim 18 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the locating the executable file of the application on the computing device and moving the executable file into a sandboxed environment in the computing device is performed in the background by an application management agent running on the computing device. ### Claim 19 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the executing the executable file inside the sandboxed environment is performed when a user of the computing device opens the application to use the application. ### Claim 20 (depends on 16) The non-transitory computer readable storage medium of claim 16, wherein the process of identifying further components of the application is terminated upon detection of a triggering event.