Patent ID: 8516509

Claim:
A method for monitoring system calls in an operating system, the operating system comprising one or more system functions, and further comprising one or more access descriptors for calling respective ones of the one or more system functions, the method comprising: loading a collector application driver providing one or more dispatch functions corresponding to respective ones of the one or more system functions; allocating a page of pinned kernel memory; creating a metadata block in the page of pinned kernel memory, wherein the metadata block comprises a copy of the one or more access descriptors corresponding to respective ones of the one or more system functions; copying the one or more dispatch functions provided by the driver into the page of pinned kernel memory, wherein the one or more dispatch functions are operable to access the metadata block; and altering the one or more access descriptors for calling respective ones of the one or more system functions to instead point to respective ones of the one or more dispatch functions copied into the page of pinned kernel memory; wherein the one or more dispatch functions are operable to call respective ones of the one or more system functions using a copy of the one or more access descriptors in the metadata block corresponding to a respective one of the one or more system functions; wherein said loading a collector application driver, allocating a page of pinned kernel memory, creating a metadata block, copying the one or more dispatch functions, and/or altering the one or more access descriptors comprise operations performed using at least one programmed computer processor circuit, wherein the collector application driver further provides, for a respective one of the one or more system functions, a pre-hook function corresponding to the respective one of the one or more system functions, and/or a post-hook function corresponding to the respective one of the one or more system functions, wherein the metadata block further comprises, for a respective one of the one or more system functions, an access descriptor for the pre-hook function corresponding to the respective one of the one or more system functions, and/or an access descriptor for the post-hook function corresponding to the respective one of the one or more system functions, and wherein the one or more dispatch functions is operable to call the pre-hook function corresponding to the respective one of the one or more system functions using the access descriptor for the pre-hook function prior to calling the respective one of the one or more system functions, and/or call the post-hook function corresponding to the respective one of the one or more system functions using the access descriptor for the post-hook function after calling the respective one of the one or more system functions.