System, method and computer program product for interception of user mode code execution and redirection to kernel mode

A computer program product embodied on a non-transitory computer readable medium comprising executable instructions stored thereon to cause one or more processors to:

• identify a first instruction from code to execute in a user mode from a first memory location, the code comprising the first instruction and subsequent second and plural additional instructions;
• use a kernel mode driver to allocate a block of user mode memory at a second memory location different from the first memory location;
• create a redirect stub in the allocated block of user mode memory that begins with a series of computer instructions that implement a trap into a kernel mode;
• copy the second and plural additional instructions from the first memory location to the allocated block of user mode memory, the second and plural additional instructions representing instructions to be intercepted;
• placing an intercept by altering instructions in the first memory, after the first instruction, to transfer control to the redirect stub;
• placing a jump instruction in the second memory after the copied instructions to return execution of the code to the first memory at a location following a last instruction of the copied instructions;
• and
• perform security operations using an internal handler in the kernel mode in response to the interception caused by execution of the code and;
• after control is passed to the internal handler via the redirect stub,
• wherein, after the security operations are performed in the kernel mode, control is returned from the kernel mode to the user mode.

A system, comprising:

• a processor;
• and
• a memory, wherein the memory stores instructions to configure the processor to:
• identify a first instruction from code to execute in a user mode from a first memory location, the code comprising the first instruction and subsequent second and plural additional instructions;
• use a kernel mode driver to allocate a block of user mode memory at a second memory location different from the first memory location;
• create a redirect stub in the allocated block of user mode memory that begins with a series of computer instructions that implement a trap into a kernel mode;
• copy the second and plural additional instructions from the first memory location to the allocated block of user mode memory, the second and plural additional instructions representing instructions to be intercepted;
• place an intercept by altering instructions in the first memory, after the first instruction, to transfer control to the redirect stub;
• place a jump instruction in the second memory after the copied instructions to return execution of the code to the first memory at a location following a last instruction of the copied instructions;
• and
• perform security operations using an internal handler in the kernel mode in response to the interception caused by execution of the code and;
• after control is passed to the internal handler via the redirect stub,
• wherein, after the security operations are performed in the kernel mode, control is returned from the kernel mode to the user mode.