Patent ID: 9645804
Date: 2017-05-09
CPC Classifications: G06F

Claim:
1. A method performed on a computer system comprising one or more computers, the method comprising: loading a process interception library in a parent process, wherein library initialization code of the process interception library overrides a default create-process function of an operating system with a custom create-process function; receiving, by the custom create-process function, a request from the parent process to create a new process; creating the new process in response to the request using the default create-process function; copying bootstrap code into the new process, wherein the bootstrap code loads the process interception library into the new process using a default library loader function; modifying the default library loader function of the new process to include an unconditional jump to the bootstrap code at a beginning of the default library loader function; and executing the new process, including jumping to the bootstrap code by the unconditional jump when the default library loader function is called, and loading the process interception library into the new process.