Vmware, Inc.

Airwatch LLC

Haim Tebeka

Craig Farley Newell

Manish Jawa

Harvey Tuch

Perry Hung

The present invention involves systems and methods for replacement of function calls. In one embodiment, a function call is intercepted and modified to enforce a policy on a client device. The function call is intercepted by scanning code loaded for a launch of an application. The function call includes a first pointer value. The function call is modified by changing a first pointer value to a second pointer value. The second pointer value points to a customized function.

Method and system for facilitating replacement of function calls

In an example, a method of creating a secured workspace in a mobile device includes installing an application management agent on the mobile device, wherein the application management agent is configured to communicate with a remote server to obtain a security policy. The method further includes installing a wrapped enterprise application to the mobile device. The wrapped enterprise application includes code injected therein that, when executed by the mobile device, causes the mobile device to intercept at least a portion of instructions being executed by the wrapped enterprise application and to interpose alternative instructions that comply with the security policy. The method further includes communicating among the wrapped enterprise application, the application management agent, and other wrapped enterprise applications through pasteboard and uniform resource locator (URL) handlers provided by an operating system of the mobile device.

Secure inter-process communication and virtual workspaces on a mobile device

One embodiment of the present invention provides system for facilitating replacement of a system function in an application with a customized function. During operation, the system shifts an existing load command in a file of an application to accommodate an additional load command. The system also adds the additional load command to the file. The additional load command identifies additional instructions that change a pointer of the application from a value that points to a system function to another value that points to a customized function.

Method and system for facilitating replacement of system calls

An example method includes modifying, prior to run time, an executable file of an application to cause an operating system loader to load additional code using a dynamically-linked library. Modifying the executable file includes determining whether the executable file includes sufficient unused space to accommodate a load command, and adding the load command to the executable file when the executable file includes sufficient unused space by: shifting, in the executable file, an existing load command that does not contain dependency information to make space for the load command; or identifying unused space outside of a data portion of the executable file that can be removed to accommodate the load command. The additional code, when executed by a processor, causes the processor to change a pointer in a table that indicates an address of an imported function implementing a system call so the pointer indicates an address of a customized function.

One embodiment of the system disclosed herein facilitates identifying a system call in an application and replacing the identified system call with a customized function call. During operation, the system executes an executable file of the application, wherein the executable file has been modified to execute a hooking and injection manager at run time. Prior to executing the system call, the system executes the hooking and injection manager. While executing the hooking and injection manager, the system determines, from a symbol table, a symbol table index value corresponding to a symbol associated with the system call. The system further determines an import table entry storing a pointer to the system call based on the symbol table index value, and changes the pointer in the import table entry so that the pointer indicates an address of the customized function call.

Method and system for identifying and replacing system calls

One embodiment of the present invention provides a system for facilitating replacement of a system call in an application with a customized function call. During operation, the system re-links the application's executable file with additional code or dynamically injects the additional code to the application's executable file during run time. The additional code can change a pointer in a table which indicates addresses of imported functions so that the pointer indicates an address of the customized function call.

Growing community of inventors

Palo Alto, CA, United States of America

Haim Tebeka