Patent ID: 7552477

Claim:
A method comprising: stalling a call to a critical operating system (OS) function; and determining whether a call module making said call to a critical operating system (OS) function was called by a call instruction, said determining whether said call module making said call to a critical operating system (OS) function was called by a call instruction comprising: examining a position of a return address of said call module making said call to a critical operating system (OS) function minus an opcode format specific offset associated with an opcode format to determine whether a call instruction opcode byte value associated with said opcode format is present; if said call instruction opcode byte value associated with said opcode format is present at said position of a return address of said call module making said call to a critical operating system (OS) function minus said opcode format specific offset, determining that said call module making said call to a critical operating system (OS) function may have been called by said call instruction opcode byte value associated with said opcode format; and if said call instruction opcode byte value associated with said opcode format is not present at said position of a return address of said call module making said call to a critical operating system (OS) function minus said opcode format specific offset, determining that said call module making said call to a critical operating system (OS) function has not been called by said call instruction opcode byte value associated with said opcode format.