Method and system for intercepting an application program interface

In a computer system running an operating system platform, said operating system including a kernel space and a process space, a user application running in process space, said user application using application program interface (API) function, whereby said API function is executed in memory space, a method of providing user control of said API function in conjunction with previously hooked API functions associated with user application and responsive to call made to said API function by said user application, said method comprising steps of:

• restoring API routine code previously stored associated with first re-direction of flow of execution to be later replaced;
• replacing API routine code with user supplied code associated with second re-direction of flow of execution of said API routine;
• calling said API routine based on response generated corresponding to whether API routine is to be executed in association with user predefined rules;
• replacing said API routine code stored with user supplied code associated with first redirection of flow of execution of said API routine;
• and
• restoring previously stored API routine code associated with second re-direction of flow of executions;
• wherein enhanced privileges relating to memory space associated with said API routine are enabled;
• wherein the steps are adapted for preventing intrusions.

In a computer system running an operating system platform, said operating system including a kernel space and a process space, a user application running in process space, said user application using application program interface (API) function, whereby said API function is executed in memory space, a method of inserting user supplied code into memory space of user application, said user supplied code operative to further control API execution, said method comprising steps of:

• injecting loader code into active process memory space associated with said user application;
• executing loader code to further load user supplied code into memory space, said user supplied code operative to further control API execution;
• injecting unloader code into active process memory space associated with said user application;
• and
• executing unloader code to further unload user supplied code from memory space;
• wherein said user supplied code replaces API routine code by:
• storing API routine code associated with first re-direction of flow of execution to be later replaced;
• storing API routine code address associated with second re-direction of flow of execution;
• storing API routine code associated with second re-direction of flow of execution;
• replacing said API routine code stored with user supplied code associated with first redirection of flow of execution of said API routine;
• wherein the steps are adapted for preventing intrusions.

In a computer system running an operating system platform, said operating system including a kernel space and a process space, a user application running in process space, said user application using application program interface (API) function, whereby said API function is executed in process space, an apparatus controlling the method of providing user control of said API function, said apparatus comprising:

• an initializer for obtaining list of active processes within computer system;
• an injector for injecting API Interception module into said active processes;
• means for monitoring predetermined system calls operative to further injection of API Interception routine into new created process;
• means for unloading API Interception routine from a process;
• and
• means for updating said list of active processes;
• means for replacing a hooked API routine code with user supplied code, comprising:
• means for storing API routine code associated with first re-direction of flow of execution to be later replaced;
• means for storing API routine code address associated with second redirection of flow of execution;
• means for storing API routine code associated with second re-direction of flow of execution;
• means for replacing said API routine code stored with user supplied code associated with first re-direction of flow of execution of said API routine;
• wherein enhanced privileges relating to memory space associated with said API routine are enabled;
• wherein the apparatus is adapted for preventing intrusions.