Patent ID: 6874149

Claim:
A method of adding new functions to an operating system on a computer, the operating system having an application programming interface (API) table stored in protected memory of the computer and the API table having pointers to existing functions also stored in protected memory of the computer, the method comprising: providing a first hooker component in unprotected memory and a second hooker component in protected memory, the first hooker component adapted to modify the API table to include one or more pointers to new functions; receiving, by the second hooker component, a request from the first hooker component to replace the API table with a replacement API table, the replacement API table having pointers to new functions; validating, by the second hooker component, the request; sending, by the second hooker component, a copy of the API table to the first hooker component; receiving, by the second hooker component, the replacement API table from the first hooker component; and using, by the operating system, the replacement API table.