Granted Patent B1

US 7,784,034 · App. 11/314,398 · Granted Aug 24, 2010

Abstract

Claims (52)

1. A method for hooking a component object model (COM) interface comprising:

receiving an identifier for a COM interface to be hooked;

creating and executing a worker thread;

wherein executing said worker thread comprises:

generating a COM apartment model comprising:

invoking a CoInitialize function to initialize a COM library and identify a concurrency model as a single-thread apartment; and

invoking a CoCreateInstance to identify matching values for each COM interface of a plurality of COM interfaces;

wherein said matching values include both a matching class identifier (CLSID) and an interface identifier (IID);

determining one of said plurality of COM interfaces that matches the CLSID and IID of said COM interface to be hooked;

wherein further comprising in response to said determining:

identifying a virtual table (vtable) for said one of said plurality of COM interfaces;

identifying an entry associated with an interface function from said vtable; and

identifying an address of the interface function to which said entry points;

hooking said one of said plurality of COM interfaces by hooking said interface function at said identified address; and

performing a function based on said hooking of said interface function.

2. The method of claim 1 , wherein subsequent invocations of the interface function are hooked.

3. The method of claim 1 , wherein the hooked interface function invocations are routed to a callback function of a intrusion detection system (IDS).

4. The method of claim 3 , wherein an entry of the interface function is hooked.

5. The method of claim 3 , wherein an exit of the interface function is hooked.

6. The method of claim 1 , wherein the interface is hooked utilizing a security application.

7. The method of claim 6 , wherein the security application includes an intrusion detection system (IDS).

8. The method of claim 1 , wherein the function includes a security function.

9. A computer program product embodied on a non-transitory computer readable medium comprising instruction that when executed by a processor performs the steps of:

receiving an identifier for a COM interface to be hooked;

creating and executing a worker thread;

wherein executing said worker thread comprises:

generating a COM apartment model comprising:

invoking a CoInitialize function to initialize a COM library and identify a concurrency model as a single-thread apartment; and

invoking a CoCreateInstance to identify matching values for each COM interface of a plurality of COM interfaces;

wherein said matching values include both a matching class identifier (CLSID) and an interface identifier (IID);

determining one of said plurality of COM interfaces that matches the CLSID and IID of said COM interface to be hooked;

wherein further comprising in response to said determining:

identifying a virtual table (vtable) for said one of said plurality of COM interfaces;

identifying an entry associated with an interface function from said vtable; and

identifying an address of the interface function to which said entry points;

hooking said one of said plurality of COM interfaces by hooking said interface function at said identified address; and

performing a function based on said hooking of said interface function.

10. A system comprising a processor that performs the steps of:

receiving an identifier for a COM interface to be hooked;

creating and executing a worker thread;

wherein executing said worker thread comprises:

generating a COM apartment model comprising:

invoking a CoInitialize function to initialize a COM library and identify a concurrency model as a single-thread apartment; and

invoking a CoCreateInstance to identify matching values for each COM interface of a plurality of COM interfaces;

wherein said matching values include both a matching class identifier (CLSID) and an interface identifier (IID);

determining one of said plurality of COM interfaces that matches the CLSID and IID of said COM interface to be hooked;

wherein further comprising in response to said determining:

identifying a virtual table (vtable) for said one of said plurality of COM interfaces;

identifying an entry associated with an interface function from said vtable; and

identifying an address of the interface function to which said entry points;

hooking said one of said plurality of COM interfaces by hooking said interface function at said identified address; and

performing a function based on said hooking of said interface function on said processor.

Assignments (8)