Patent Number: 6,253,258

Title: Subclassing system for computer that operates with portable-executable (PE) modules

Abstract: The export record of an operating system kernel employing dynamically-linked loading modules (e.g., portable-executable modules) is thunked so as to globally and forcibly redirect service requests from afterwards loaded modules to subclassing routines instead of to original servicing routines of the kernel. The base location of the kernel is determined from an Image_Base entry of its disk-image. An offset storing position in the export record is overwritten with a value equal to the value of the address of the subclassing routine minus the kernel's base address. Use of the thunked export record is forced even for `bound` external references by altering the time stamp in the kernel's export record to a nonmatching value.

Inventors: Cohen; Leo (Los Angeles, CA)

Assignee: Symantec Corporation

International Classification: G06F 9/445 (20060101); G06F 009/40 ()

Expiration Date: 06/26/2018