Generic framework for runtime interception and execution control of interpreted languages
View Patent ↗A system and method for controlling execution of an interpreted language. Statements of the interpreted language to be executed by a script engine are intercepted by a protection module and control is passed to a script helper module that is asociated with the script engine. The script helper module establishes a secure communications channel with an authorization component and passes the statements and an authorization request to the authorization component. The authorization component sends a reply to the script helper module which either permits the script engine to execute the statement or cancels the attempted execution. When the script engine is loaded, a list is updated identifying the script engine. If a script helper module is not present for the loaded script engine, a boot-strap loader is called to load the script helper module. A special information block contains data as to the location of the interception points.
1. A method for controlling the execution of a statement of interpreted computer language code, the method comprising the steps of:
determining that a statement of computer language code is attempting execution or that there is an invocation request to execute a statement of computer language code;
intercepting the statement or invocation request prior to execution of the computer language code;
passing control to a script helper module associated with a script engine able to interpret the statement of computer language code if a script helper module is present;
passing control to a boot-strap loader if a script helper module is not present, retrieving an address of an information block (IDD) associated with a script engine able to interpret the statement of computer language code, wherein the information block identifies a script helper module associated with the script engine, and loading the script helper module identified in the information block;
accessing the interpreted language code using the script helper module;
identifying origin information relating to the statement of computer language code;
establishing a secure communications channel with an authorization component;
sending the interpreted language code over the channel with the identified origin information;
receiving a reply from the authorization component;
passing the original statement of computer language code or invocation request to the script engine, if execution thereof is permitted; and
canceling the attempting execution of invocation request, if execution of the code is not permitted.
2. A method for controlling execution of a statement of interpreted computer language code as recited in claim 1 , wherein the information block (IDD) identifies a list of routines that must be intercepted.
3. A method for controlling execution of a statement of interpreted computer language code as recited in claim 2 , further comprising, prior to passing control to the boot- strap loader if a script helper module is not present, passing control to a trampoline structure that invokes the boot-strap loader, wherein the trampoline structure includes an address of a boot- strap block and a short sequence of code, wherein passing control to the trampoline structure includes executing the short sequence of code in the trampoline structure.
4. A method for controlling execution of a statement of interpreted computer language code as recited in claim 1 , further comprising, prior to the step of determining that a statement of computer language code is attempting execution or that there is an invocation request to execute a statement of computer language code, loading the script engine that is able to interpret the statement of computer language code.
5. A method for controlling execution of a statement of interpreted computer language code as recited in claim 4 , wherein the step of loading a script engine that is able to interpret the statement of computer language code further includes:
obtaining an IDD for the script engine that interprets the statement of the computer language code;
obtaining a list of export routines that must be intercepted and a location of the script helper module from the IDD; and
adding a pointer from the script engine and adding its IDD to a list of loaded script engines.
6. A method for controlling execution of a statement of interpreted computer language code as recited in claim 1 , further comprising, prior to the step of intercepting the statement or invocation request prior to execution of the computer language code, setting up an intercept structure.
7. A method for controlling execution of a statement of interpreted computer language code as recited in claim 6 , wherein the step of setting up the intercept structure includes:
traversing an in-memory runnable image of the script engine to locate one or more routines described in its IDD that must be intercepted;
storing one or more entry point addresses of the one or more routines that must be intercepted in a trampoline structure; and
overwriting the one or more original entry point addresses in the script engine to be the one or more entry points of the trampoline structure, wherein the trampoline structure includes the address of the intercepted routine, the address of the intercepting routine, an address of a boot- strap block, an integer tag and a short sequence of code.
8. A method for controlling execution as recited in claim 1 , wherein the reply from the authorization component is either a preset reply if there is match between a set of stored identities and the intercepted language statements and said preset reply exists or is a user reply in response to a query sent to a user.
9. A method for controlling execution as recited in claim 8 , wherein the reply is a denial of permission if there is match, but no preset reply.