Antivirus System Call Table Interception via Kernel Stack Retrieval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Some operating systems do not include the address of the system call table in the kernel map, preventing application programs from accessing it and hindering antivirus scanning for computer viruses.
Innovation Solution
A user-level program invokes a first system call to retrieve the address of the system call table from the kernel stack, allowing the antivirus to modify the table for intercepting and scanning system calls before execution, even in systems where the address is not listed in the kernel map.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the operating system includes the system call table address in system.map, then application programs can easily access the system call table, but the system loses security and flexibility in controlling system call access
Solution Approach 1:
The patent introduces an intermediary mechanism where the system call table address is retrieved dynamically from kernel space through a system call during runtime, rather than being statically exposed in system.map. This intermediary process allows controlled access to the system call table address while maintaining system security, as the address is obtained through legitimate system call interfaces rather than direct file access.
2Adaptability or versatility
If the operating system excludes the system call table address from system.map, then system security and control flexibility are improved, but application programs cannot locate the system call table for antivirus scanning
Solution Approach 1:
The patent implements a self-service mechanism where the antivirus application program itself retrieves the system call table address by invoking a system call during runtime. Instead of relying on the operating system to provide the address through system.map, the antivirus program autonomously obtains the address through legitimate system interfaces, enabling it to function in secure operating systems while maintaining its antivirus capabilities.
3Adaptability or versatility
If the system call table address is dynamically retrieved from kernel stack, then compatibility with secure operating systems is improved, but the complexity of the antivirus implementation increases
Solution Approach 1:
The patent changes the fundamental parameter of how the system call table address is obtained - from a static file-based approach (system.map) to a dynamic runtime approach (kernel stack retrieval via system call). This parameter change enables compatibility with secure operating systems while the increased implementation complexity is managed through systematic use of existing system call interfaces and standard programming practices.
Data Source
AI summary
In one embodiment, an address of a system call table is determined by invoking a first system call from a user-level program running in user space. When the first system call executes, the first system call retrieves the address of the system call table from kernel stack, which that has been populated by the kernel with various data including the address of the system call table. Using the retrieved address to locate the system call table, the system call table is modified to allow interception of calls made to one or more system calls included in the system call table. This allows a scan module to scan data for computer viruses before a system call is allowed to execute and operate on the data, for example.