Patent ID: 9747452
Date: 2017-08-29
CPC Classifications: G06F

Claim:
1. A method for generating an in-kernel hook point candidate, comprising steps of: checking whether an in-kernel access instruction matches a specific format, wherein the in-kernel access instruction uses an index pointer and an offset value associated with the index pointer; recording the offset value of the in-kernel access instruction in an instruction list structure if the in-kernel access instruction matches the specific format; recording a memory address corresponding to the in-kernel access instruction in the instruction list structure and recording an initializing memory address of the instruction list structure as the in-kernel hook point candidate if the index pointer points to one of a stack pointer and a frame pointer; if the index pointer does not point to one of a stack pointer and a frame pointer, performing a backward-slicing operation on the instruction list structure if the in-kernel access instruction does not conform to either one of conditions of matching the specific format and pointing to one of the stack pointer and the frame pointer; and outputting the recorded initializing memory address of the instruction list structure as the in-kernel hook point candidate.