METHOD OF CREATING A SYSTEM CALL HANDLER Russian patent published in 2016 - IPC G06F21/00 

FIELD: information technology.

SUBSTANCE: invention relates to antivirus technologies, particularly to a method of creating handler system calls. Way to contact modified system call handler of system calls in Windows operating system consists of steps where: localized code of original handler system calls; modified system call handler is created by memory allocation and copying code to original handler additionally, the next step is performed: changing the address of the original handler on the address of the modified handler; intercepted call processor instructions associated with a system call, using a hypervisor; saved value register MSR using a hypervisor for its return process Patch Guard when reading the last value of register MSR for correct work of the operating system; one contacts a modified system call for interception operations associated with removal of images of the screen.

EFFECT: technical result of this invention is providing the possibility of processing system calls.

1 cl, 7 dwg