Patent ID: 8572729

Claim:
A method, comprising: identifying a first instruction in code prior to executing the code, the code to execute in a user mode from a first memory location, the code comprising the first instruction and subsequent second and plural additional instructions; using a kernel mode driver to allocate a block of user mode memory at a second memory location different from the first memory location; creating a redirect stub in the allocated block of user mode memory that begins with a series of computer instructions that implement a trap into a kernel mode; copying the second and plural additional instructions from the first memory location to the allocated block of user mode memory, the second and plural additional instructions representing instructions to be intercepted; placing an intercept by altering instructions in the first memory, after the first instruction, to transfer control to the redirect stub; placing a jump instruction in the second memory after the copied instructions to return execution of the code to the first memory at a location following a last instruction of the copied instructions; and causing performing security operations using an internal handler in the kernel mode in response to the interception caused by execution of the code and after control is passed to the internal handler via the redirect stub, wherein, after the security operations are performed in the kernel mode, control is returned from the kernel mode to the user mode.