# US 8,572,729 B1 · System, method and computer program product for interception of user mode code execution and redirection to kernel mode

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,572,729 B1
- Document ID: US8572729B1
- Status: Granted
- Kind: B1
- Application number: 11/344,431
- Filed: 2006-01-30
- Granted: 2013-10-29
- Earliest claimed: 2006-01-30
- Assignees: McAfee, Inc.
- Applicants: Joe C. Lowe; Jonathan L. Edwards; Gregory William Dalcher
- Inventors: Joe C. Lowe; Jonathan L. Edwards; Gregory William Dalcher
- Web page: https://patentgrep.com/patent/US8572729B1

## CPC

- G06F 21/54: by adding security routines or objects to programs
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/554: {involving event detection and direct action}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system, method and computer program product are provided. In use, code is executed in user mode. Further, the execution of the code is intercepted. In response to the interception, operations are performed in kernel mode.

## Claims

### Claim 1

A method, comprising:
identifying a first instruction in code prior to executing the code, the code to execute in a user mode from a first memory location, the code comprising the first instruction and subsequent second and plural additional instructions;
using a kernel mode driver to allocate a block of user mode memory at a second memory location different from the first memory location;
creating a redirect stub in the allocated block of user mode memory that begins with a series of computer instructions that implement a trap into a kernel mode;
copying the second and plural additional instructions from the first memory location to the allocated block of user mode memory, the second and plural additional instructions representing instructions to be intercepted;
placing an intercept by altering instructions in the first memory, after the first instruction, to transfer control to the redirect stub;
placing a jump instruction in the second memory after the copied instructions to return execution of the code to the first memory at a location following a last instruction of the copied instructions; and
causing performing security operations using an internal handler in the kernel mode in response to the interception caused by execution of the code and
after control is passed to the internal handler via the redirect stub,
wherein, after the security operations are performed in the kernel mode, control is returned from the kernel mode to the user mode.

### Claim 2 (depends on 1)

The method of claim 1, wherein the security operations include diagnostic operations.

### Claim 3 (depends on 1)

The method of claim 1, wherein the security operations include maintenance operations.

### Claim 4 (depends on 1)

The method of claim 1, wherein the security operations preclude malware from executing.

### Claim 5 (depends on 1)

The method of claim 1, wherein the security operations include identifying an application that is running, and conditionally allowing user mode functions to be performed based on the identified application.

### Claim 6 (depends on 1)

The method of claim 1, wherein the security operations include examining memory attributes associated with user mode code segments.

### Claim 7 (depends on 1)

The method of claim 1, wherein the security operations include precluding code residing in writeable memory from making calls.

### Claim 8 (depends on 1)

The method of claim 1, wherein the security operations that are performed in the kernel mode after control is passed to the internal handler include kernel mode code operations to identify a name of an application that is executing the code in the user mode, and only allow applications with certain names to execute particular user mode functions.

### Claim 9

A computer program product embodied on a non-transitory computer readable medium comprising executable instructions stored thereon to cause one or more processors to:
identify a first instruction from code to execute in a user mode from a first memory location, the code comprising the first instruction and subsequent second and plural additional instructions;
use a kernel mode driver to allocate a block of user mode memory at a second memory location different from the first memory location;
create a redirect stub in the allocated block of user mode memory that begins with a series of computer instructions that implement a trap into a kernel mode;
copy the second and plural additional instructions from the first memory location to the allocated block of user mode memory, the second and plural additional instructions representing instructions to be intercepted;
placing an intercept by altering instructions in the first memory, after the first instruction, to transfer control to the redirect stub;
placing a jump instruction in the second memory after the copied instructions to return execution of the code to the first memory at a location following a last instruction of the copied instructions; and
perform security operations using an internal handler in the kernel mode in response to the interception caused by execution of the code and;
after control is passed to the internal handler via the redirect stub,
wherein, after the security operations are performed in the kernel mode, control is returned from the kernel mode to the user mode.

### Claim 10 (depends on 9)

The computer program product of claim 9, wherein the security operations include diagnostic operations.

### Claim 11 (depends on 9)

The computer program product of claim 9, wherein the security operations include maintenance operations.

### Claim 12 (depends on 9)

The computer program product of claim 9, wherein the security operations preclude malware from executing.

### Claim 13 (depends on 9)

The computer program product of claim 9, wherein the security operations include identifying an application that is running, and conditionally allowing user mode functions to be performed based on the identified application.

### Claim 14 (depends on 9)

The computer program product of claim 9, wherein the security operations include examining memory attributes associated with user mode code segments.

### Claim 15 (depends on 9)

The computer program product of claim 9, wherein the security operations include precluding code residing in writeable memory from making calls.

### Claim 16

A system, comprising:
a processor; and
a memory, wherein the memory stores instructions to configure the processor to:
identify a first instruction from code to execute in a user mode from a first memory location, the code comprising the first instruction and subsequent second and plural additional instructions;
use a kernel mode driver to allocate a block of user mode memory at a second memory location different from the first memory location;
create a redirect stub in the allocated block of user mode memory that begins with a series of computer instructions that implement a trap into a kernel mode;
copy the second and plural additional instructions from the first memory location to the allocated block of user mode memory, the second and plural additional instructions representing instructions to be intercepted;
place an intercept by altering instructions in the first memory, after the first instruction, to transfer control to the redirect stub;
place a jump instruction in the second memory after the copied instructions to return execution of the code to the first memory at a location following a last instruction of the copied instructions;
and
perform security operations using an internal handler in the kernel mode in response to the interception caused by execution of the code and;
after control is passed to the internal handler via the redirect stub,
wherein, after the security operations are performed in the kernel mode, control is returned from the kernel mode to the user mode.

### Claim 17 (depends on 16)

The system of claim 16, wherein the security operations preclude malware from executing.

### Claim 18 (depends on 16)

The system of claim 16, wherein the security operations include identifying an application that is running, and conditionally allowing user mode functions to be performed based on the identified application.

### Claim 19 (depends on 16)

The system of claim 16, wherein the security operations include examining memory attributes associated with user mode code segments.

### Claim 20 (depends on 16)

The system of claim 16, wherein the security operations include precluding code residing in writeable memory from making calls.