Symantec Corporation

Leo Cohen

Alfred C Hartmann

Brendon Woirhaye

Charlotte Chang

Archana S Rajan

Christopher Alexander

Gary Sabala

Wei Lin

Security from malicious attack is provided for a user environment running in a virtualized environment by a virtual security appliance (VSA) running outside of the user environment, but on the same computer system as the user environment. For example, a VSA running in a virtual machine can provide security for a user environment running in a second virtual machine. The separation of the VSA from the user environment enhances the robustness of the VSA against malicious attacks seeking to disable/bypass the protections of the VSA, while avoiding the costs and complexities of a physical security appliance.

Virtual security appliance

The export record of an operating system kernel employing dynamically-linked loading modules (e.g., portable-executable modules) is thunked so as to globally and forcibly redirect service requests from afterwards loaded modules to subclassing routines instead of to original servicing routines of the kernel. The base location of the kernel is determined from an Image_Base entry of its disk-image. An offset storing position in the export record is overwritten with a value equal to the value of the address of the subclassing routine minus the kernel's base address. Use of the thunked export record is forced even for 'bound' external references by altering the time stamp in the kernel's export record to a nonmatching value.

Subclassing system for computer that operates with portable-executable (PE) modules

Growing community of inventors

Tarzana, CA, United States of America

Leo Cohen