Patent ID: 9098704
Filing Date: 2015-08-04
Classification: G06F

Abstract:
1. A computer-implemented method for intercepting and re-calling an application function, the method comprising: launching an application executing at least one function having at least one parameter; starting an interceptor module; intercepting the function using the interceptor module, wherein the interceptor module performs direct modifications of an executable code of the function from a process memory through splicing and creates hooks for specific events taking place during execution of the application; acquiring function parameters and storing the function parameters in a stack; passing the function parameters to an analyzer; analyzing the function parameters for malware; terminating the application, when the malware is detected by the analyzer; and preparing a parameter stack and re-calling the function, when malware is not detected, and calling the function again with the parameters stored in the stack, where an initial function return address is stored in the stack at an address following a current stack pointer.