Patching system calls in data protection operations
View Patent ↗Systems and methods for patching system calls issued on a device. System calls are patched by transforming system calls to provide additional functionality. The system calls can then be rerouted to the updated or custom functions.
1. A method for patching a system call, the method comprising:
backing up default functions of a block device associated with the system call in a backup copy of a block device operations structure, wherein the backup copy includes the default functions associated with the system call;
associating the block device operations structure with custom functions associated with a specific application, wherein the default functions and the custom functions are available to the system call; and
performing the custom functions when the system call is issued by the specific application; and
performing the default functions when the system call is issued by a different application.
2. The method of claim 1 , wherein the block device operations structure includes pointers to the default functions and wherein the block device operations structure includes pointers to the custom functions.
3. The method of claim 1 , wherein the specific application is a data protection application.
4. The method of claim 1 , further comprising opening the block device associated with the system call.
5. The method of claim 1 , further comprising overwriting the default functions in the block device operations structure with the custom functions.
6. The method of claim 1 , further comprising removing the custom functions from the block device operations structure.
7. The method of claim 1 , further comprising restoring the default functions to the block device operations structure.
8. The method of claim 1 , further comprising performing the specific application.
9. The method of claim 1 , wherein the specific application comprises a data protection application and wherein the system call relates to a write tracking driver in a kernel.
10. The method of claim 1 , further comprising determining which of the specific application and the different application issued the system call based on one or more of a device identifier and a request code included with the system call.
11. A non-transitory computer readable medium comprising computer executable instructions for performing a method for patching a system call, the instructions comprising:
backing up default functions of a block device associated with the system call in a backup copy of a block device operations structure, wherein the backup copy includes the default functions associated with the system call;
associating the block device operations structure with custom functions associated with a specific application, wherein the default functions and the custom functions are available to the system call; and
performing the custom functions when the system call is issued by the specific application; and
performing the default functions when the system call is issued by a different application.
12. The non-transitory computer readable medium of claim 11 , wherein the block device operations structure includes pointers to the default functions and wherein the block device operations structure includes pointers to the custom functions.
13. The non-transitory computer readable medium of claim 11 , further wherein the specific application is a data protection application.
14. The non-transitory computer readable medium of claim 11 , the instructions further comprising opening the block device associated with the system call.
15. The non-transitory computer readable medium of claim 11 , the instructions further comprising overwriting the default functions in the block device operations structure with the custom functions.
16. The non-transitory computer readable medium of claim 11 , the instructions further comprising removing the custom functions from the block device operations structure.
17. The non-transitory computer readable medium of claim 11 , the instructions further comprising restoring the default functions to the block device operations structure.
18. The non-transitory computer readable medium of claim 11 , the instructions further comprising performing the specific application.
19. The non-transitory computer readable medium of claim 11 , wherein the specific application comprises a data protection application and wherein the system call relates to a write tracking driver in a kernel.
20. The non-transitory computer readable medium of claim 11 , the instructions further comprising determining which of the specific application and the different application issued the system call based on one or more of a device identifier and a request code included with the system call.