Method and apparatus for providing seamless hooking and intercepting of selected kernel and HAL exported entry points in an operating system

A computer system comprising:

• at least one host processor;
• an operating system having a hardware abstraction layer associated therewith, said hardware abstraction layer having at least one entrypoint;
• a module for hooking said at least one entrypoint;
• said module further for selectively executing a routine subsequent to hooking said at least one entrypoint;
• and
• said module for hooking said at least one entrypoint further for determining if said at least one entrypoint begins with a first byte, wherein the first byte is a one byte instruction, such that if the determination is made that said at least one entrypoint does not begin with a one byte instruction, said at least one entrypoint is not hooked.

In a computer system comprising at least one host processor, the host processor comprising an interrupt descriptor table and a harware abstraction layer, the hardware abstraction layer comprising a hardware abstraction layer table of system processor control registers, and a module providing a method for selectively hooking a public entrypoint having a logical address, said method of selectively hooking a public entrypoint comprising the steps of:

• determining if the entrypoint begins with a one byte instruction, such that if the determination is made that the first byte of the entrypoint is a one byte instruction;
• saving the address of the public entrypoint;
• and
• placing an interrupt instruction into the first byte of the entrypoint.

A method of selectively hooking a public entrypoint in a computer system comprising at least one host processor, the host processor comprising an interrupt descriptor table and a hardware abstraction layer, the hardware abstraction layer comprising a hardware abstraction layer table of system processor control registers, the method comprising the acts of:

• determining whether the public entrypoint begins with a one byte instruction;
• and
• if the public entrypoint begins with a one byte instruction:
• saving the address of the public entrypoint;
• placing an interrupt instruction into the first byte of the public entrypoint;
• and
• scanning the hardware abstraction layer for the hardware abstraction layer table of system processor control registers for the at least one host processor.