Patent Publication Number: US-7584480-B1

Title: Method of monitoring multiple computer system calls using one routine and non-executable configuration file

Description:
FIELD OF INVENTION 
   The present invention relates, in general, to electrical computers and digital processing systems and, in particular, to event notification. 
   BACKGROUND OF THE INVENTION 
   One method of monitoring the operation of a computer program (i.e., a computer process) is to monitor the branches or jumps from the program to one or more system calls. A system call is a routine that accomplishes a system-level (i.e., operating system) function on behalf of a computer process (e.g., memory allocation, accessing input or output devices). A system call is performed by the program being executed in order to execute a system-level routine. System calls are made by using a system call table in the computer&#39;s operating system. The routine that is called is responsible for returning control to the calling program after it has finished processing. 
   There are many different types of system calls. For example, the Windows NT/2000 operating system has system calls for System Information and Control (e.g., ZwQuerySystemInformation), Objects (e.g., ZwQueryObject), Virtual Memory (e.g., ZwAllocateVirtualMemory), Sections (e.g., ZwCreateSection), Threads (e.g., ZwSuspendThread), Processes (e.g., ZwTerminateProcess), Jobs (e.g., ZwAssignProcessToJobObject), Tokens (e.g., ZwDuplicateToken), Synchronization (e.g., ZwSetEvent), Time (e.g., ZwQueryPerformanceCounter), Execution Profile (e.g., ZwStartProfile), Ports (e.g., ZwConnectPort), Files (e.g., ZwReadFile), Registry Keys (e.g., ZwLoadKey), Security and Auditing (e.g., ZwAccessCheck), Power Management (e.g., ZwGetDevicePowerState), and Miscellany (e.g., ZwLoadDriver). Each system call has a routine associated with it that could require certain input data and produce certain output data. 
   The prior art method of monitoring system calls is to modify a system call table in a computer operating system so that each pointer in the table that would otherwise cause the program that does a system call to jump to the corresponding system call routine would cause the program to jump to another unique routine. Each unique routine would call its corresponding system call routine. The system call routine would execute as requested and return information to the unique routine that called it. The unique routine could then record whatever information about the system call that is possible. The unique routine would then return the output of the system call routine to the program so that the program could continue. To the program, it looks like it called a system call routine and received the result. However, the unique routine monitored the system call. A different custom routine is required for each system call, because each system call could require different parameters as input and produce different outputs. Skilled computer scientists are needed to write such routines, and every time a routine is added to a program, the program must be recompiled. Such tasks are prone to error and are expensive. 
   U.S. Pat. No. 6,735,774, entitled “METHOD AND APPARATUS FOR SYSTEM CALL MANAGEMENT,” discloses a device for and a method of managing system call that is in accordance with the prior art method described above. The present invention does not manage system calls as does U.S. Pat. No. 6,735,774, and U.S. Pat. No. 6,735,744 does not disclose the method of the present invention. U.S. Pat. No. 6,735,774 is hereby incorporated by reference into the specification of the present invention. 
   U.S. Pat. Appl. No. 20050066322 A1, filed on Sep. 18, 2003 now U.S. Pat. No. 7,412,694 entitled “METHOD FOR DETECTING PROGRAM PHASES WITH PERIODIC CALL-STACK SAMPLING,” discloses a method of monitoring system calls by counting the number of stack frames that are created in response to system calls. The present invention does not monitor system calls by counting stack frames created in response to system calls as does U.S. Pat. Appl. No. 20050066322 A1. Now U.S. Pat. No. 7,412,694 U.S. Pat. Appl. No. 20050066322 A1 is hereby incorporated by reference into the specification of the present invention. 
   There is a need for a method of monitoring systems calls that does not require unique routines for each system call to be monitored, specialized computer science skills, and recompiling with every addition or deletion of a system call to be monitored. The present method satisfies this need. 
   SUMMARY OF THE INVENTION 
   It is an object of the present invention to monitor system calls done by a computer program. 
   It is another object of the present invention to monitor system calls done by a computer program without requiring unique routines for each system call to be monitored. 
   It is another object of the present invention to monitor system calls done by a computer program without requiring recompilation with every addition or deletion of a system call to be monitored. 
   The present invention is a method of monitoring multiple computer system calls using one routine and a non-executable configuration file that does not require recompilations when additions or deletions are made to the system called to be monitored. 
   The first step of the method is determining a user-definable number of system calls to be monitored. 
   The second step of the method is determining data to be recorded for each system call determined in the first step. 
   The third step of the method is creating a non-executable configuration file that includes the system calls and associated data determined in the first step and the second step, respectively. 
   The fourth step of the method is modifying a system call table in a computer operating system to replace pointers to routines that correspond to system calls determined in the first step with pointers to a user-definable routine. 
   If a system calls determined in the first step occurs during the execution of a computer program then the fifth step of the method is jumping to and executing the user-definable routine to which the system call table points, where the user-definable routine is comprised of the following steps. 
   The first substep of the fifth step is reading the non-executable configuration file to determine what data to record for the system call that occurred. 
   The second substep of the fifth step is jumping to a system call routine to execute the system call that occurred. 
   The third substep of the fifth step is returning from the system call routine to the user-definable routine with data produced by the system call routine. 
   The fourth substep of the fifth step is recording the data returned from the system call routine that is included in the non-executable configuration file for the system call. 
   The sixth, and last, step of the method is returning to the fifth step to monitor other system calls. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
       FIG. 1  is a flowchart of the steps of the present invention; and 
   

   DETAILED DESCRIPTION 
   The present invention is a method of monitoring multiple computer system calls using one routine and a non-executable configuration file that is not recompiled if any additions or deletions are made to the systems calls to be monitored. 
     FIG. 1  is a flowchart of the method of the present invention. 
   The first step  1  of the method is determining a user-definable number of system call types to be monitored. In the preferred embodiment, the system calls monitored are system calls in a Microsoft Windows operating system (e.g., Windows 2000, Windows XP). However, the present invention applies to system calls from any operating system. 
   The second step  2  of the method is determining data to be recorded for each system call type determined in the first step  1 . The complete set of data from which a user may choose includes all input data to and/or output data from the system call routines determined in the first step  1 . 
   The third step  3  of the method is creating a non-executable configuration file that includes the system call types and associated data determined in the first step  1  and the second step  2 , respectively. In the preferred embodiment, the non-executable configuration file is a file written in Extensible Markup Language (XML). However, any other suitable non-executable configuration file may be used. Such a file may be modified to add or delete system calls to be monitored without the need to recompile the file. No specialized computer science skills are required to make such modifications. 
   The fourth step  4  of the method is modifying a system call table in a computer operating system to replace pointers to routines that correspond to system calls determined in the first step  1  with pointers to a user-definable routine. 
   If a system call type determined in the first step  1  occurs during the execution of a computer program then the fifth step  5  of the method is jumping to and executing the user-definable routine. 
   The steps required to accomplish the fifth step  5  above are as follows. The first substep  5   a  of the fifth step  5  is reading the non-executable configuration file to determine what data to record for the system call type that occurred. In the preferred method, the non-executable configuration file is an XML file. However, any other non-executable configuration file will do. 
   The second substep  5   b  of the fifth step  5  is jumping to a system call routine to execute the system call that occurred. 
   The third substep  5   c  of the fifth step  5  is returning from the system call routine to the user-definable routine with data produced by the system call routine. 
   The fourth substep  5   d  of the fifth step  5  is recording the data returned from the system call routine that is included in the non-executable configuration file for the system call. In the preferred method, the data is recorded into the computer&#39;s memory. However, any other sufficient storage medium will do. 
   The sixth, and last, step of the method is returning to the fifth step  5  to monitor for other system calls. 
   In an alternate embodiment, the data recorded in the fourth substep  5   d  of the fifth step  5  is reported. Any suitable reporting method will do.