Method and apparatus for providing seamless hooking and intercepting of selected kernel and hal exported entry points

A computer system comprising:

• at least one host processor;
• an operating system comprising a hardware abstraction layer associated therewith, the hardware abstraction layer comprising at least one entrypoint;
• a module for determining whether the at least one entrypoint comprises a first byte, the first byte comprising a one byte instruction and, if the at least one entrypoint comprises the instruction, hooking said at least one entrypoint;
• and
• the module further for selectively executing a routine subsequent to hooking said at least one entrypoint.

A computer system comprising:

• a processor;
• an operating system executable by the processor, the operating system comprising an entrypoint;
• and
• a module in communication with the operating system, the module configured to hook the entrypoint;
• wherein the module is configured (i) to determine an origin of a call to the hooked entrypoint, such that a new interrupt routine is selectively executed based on the determined origin and (ii) to determine if the entrypoint begins with a first byte comprising at least one byte of an instruction, such that if the determination is made that the entrypoint does not begin with the instruction, the entrypoint is not hooked.

A computer system comprising:

• a processor;
• an operating system executable by the processor, the operating system comprising an entrypoint;
• and
• a module in communication with the operating system, the module configured to hook the entrypoint;
• wherein the module is configured (i) to determine an origin of a call to the hooked entrypoint, such that a new interrupt routine is selectively executed based on the determined origin, and (ii) to determine whether the entrypoint comprises a first byte, the first byte comprising a one-byte instruction, and, if so, to hook the at least one entrypoint.

A computer system comprising:

• a processor;
• an operating system executable on the processor, the operating system comprising an entrypoint;
• and
• a module in communication with the operating system, the module configured to modify the entrypoint;
• wherein the module is configured to determine whether the entrypoint comprises a first byte, the first byte comprising a one-byte instruction, and, if so, to modify the entrypoint.

In a computer system comprising a processor and an operating system, the operating system comprising an entrypoint having a logical address, a method of hooking the entrypoint, the method comprising the acts of:

• determining if the entrypoint comprises a first byte, the first byte comprising a one-byte instruction,
• if so, saving the logical address of the entrypoint;
• and
• placing an interrupt instruction into the entrypoint.