Symantec Corporation

Hewlett-packard Development Company, L.P.

Thomas Lofgren

Brian Hernacki

Jeremy Bennett

Robert Hundt

Umesh Krishnaswamy

Vinodha Ramasamy

Eric Gouriou

David John Babcock

Jose German Rivera

Remote activation of covert service channels is provided. A remote host can initiate and establish a connection with a target host without exposing a service channel or communications port to an unauthenticated host. Triggers can be received by and sent to a host and an associated operating system, under direction of a stealth listener. The stealth listener provides can control and direct an operating system to respond to incoming data packets, but can also open and close ports to enable access to services on a host. Using a variety of transport mechanisms, protocols, and triggers to covertly enable a connection to be established between a service and a remote client, the disclosed techniques also enable reduction of processing and storage resources by reducing the amount of host or client-installed software.

Remote activation of covert service channels

Method and apparatus for dynamic instrumentation of an executable application program. The application program includes a plurality of functions, each function having an entry point and an endpoint. When the application is executed, a shared memory segment is created for an instrumentation program and the application program. Upon initial invocation of the original functions in the application program, corresponding substitute functions are created in the shared memory segment, the substitute versions including instrumentation code. Thereafter, the substitute functions are executed in lieu of the original functions in the application program.

Dynamic instrumentation of an executable program by means of causing a breakpoint at the entry point of a function and providing instrumentation code

Growing community of inventors

Sunnyvale, CA, United States of America

Thomas Lofgren