Patent ID: 7552479

Claim:
A method comprising: locating an initial process import address table (IAT) of a process, said initial process IAT including one or more initial process IAT entries corresponding to one or more imported functions, said one or more initial process IAT entries including at least one initial process IAT entry corresponding to a critical imported function; generating a critical imported functions table, said critical imported functions table including at least one critical imported functions table entry, wherein said critical imported functions table entry includes an address in memory corresponding to said critical imported function; generating a reference copy IAT, said reference copy IAT including one or more reference copy IAT entries that are copies of said one or more initial process IAT entries; generating a resolved copy IAT, said resolved copy IAT including one or more resolved copy IAT entries, wherein each of said one or more resolved copy IAT entries includes an address for a corresponding one of each of said one or more initial process IAT entries; hooking said critical imported function; stalling a call to said critical imported function thereby preventing said call from reaching said critical imported function; and redirecting said call to said critical imported function utilizing said critical imported functions table entry corresponding to said critical imported function.