Patent ID: 7703081

Claim:
A method comprising: dynamically generating a new system service table in a computer system, wherein said new system service table comprises: one or more new system service table entries, wherein each of said one or more new system service table entries corresponds to a different original system service table entry in an original system service table; and one or more stub functions, wherein each of said one or more stub functions corresponds to a separate new system service table entry; locating currently running program threads on said computer system; replacing an original system service table thread value in each of said currently running program threads with a new system service table thread value, such that said currently running program threads utilize said new system service table to call operating system functions rather than said original system service table; installing a first hook in said new system service table such that calls from said currently running program threads to an operating system function which creates a child program thread are directed to a thread modification code, wherein said thread modification code replaces said original system service table thread value in said child program thread with said new system service table thread value; and installing at least a second hook in said new system service table such that a call to an operating system function is directed to an alternate code.