DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
2. This Office Action is directed to the Applicant’s response filed on 10-1-2025.
3. Claims 1-3, 5, 8-10, 13-15, 18, and 20-28 are pending and have been examined.
Terminal Disclaimer
4. The terminal disclaimer filed on 10-1-2025 disclaiming the terminal portion of any patent granted on this application which would extend beyond the expiration date of US Patent 11,636,197 has been reviewed and is accepted. The terminal disclaimer has been recorded.
Claim Rejections - 35 USC § 112
5. The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
6. Claims 1-3, 5, 8-10, 13-15, 18, and 20-28 are rejected under 35 U.S.C. 112(b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
As for claim 5, the claim recites the passage: “The system of claim 1, wherein the one or more processors are configured to modify the RVA comprises: by storing…”. It is unclear what this passage means and therefore the claim is indefinite.
As for claim 27, the claim recites the passage: “The system of claim 26, wherein the one or more processors are further configured to continues the binary search the remaining half…”. It is unclear what this passage means and therefore the claim is indefinite.
As for claims 1, 13, and 20, the terms: “expected address range” and “access restricted memory location”, and the limitations: "processing a received exception" and "performing remedial action" in claims 1, 13, and 20 are ambiguous terms and limitations respectively that render the claims indefinite.
The term “expected address range” is a relative term that is not defined by the claim. Additionally, the specification does not provide a standard for ascertaining the requisite degree. Therefore one of ordinary skill in the art would not be reasonably apprised of the scope of the invention.
The term "expected address range" is indefinite because the specification, at paragraph [0004] for example, provides only a qualitative description: "…boundaries of the expected system library addresses…" without identifying a quantitative measure or algorithm for determining the range. It is unclear whether this range refers to (1) all legitimate address boundaries of a whitelisted module, (2) an operating system-defined memory segment, or (3) any address region the ATF module’s exception handler subjectively deems "expected". As a result, a person of ordinary skill in the art could not reasonably ascertain the metes and bounds of the claim.
The term "access-restricted memory location" is ambiguous. The specification at for example paragraph [0014] references “PAGE_NOACCESS” and the UNIX mprotect command, but these represent general operating system features, not definite structural limitations. The claim language therefore reads on any memory location having reduced permissions, leaving its scope indefinite and overly broad.
Further, the recitations of the limitations: "processing a received exception" and "performing remedial action" are purely functional and omit the manner of performance. The specification discloses only generic results (e.g. generate warning, terminate process, quarantine file) without describing the specific mechanism by which those actions are triggered or executed.
Claims 2, 3, 5, 8-10 and 21-28 are dependent on claim 1 and do not cure its deficiencies. Therefore, they are rejected on the same basis as claim 1.
Claims 14, 15, and 18 are dependent on claim 13 and do not cure its deficiencies. Therefore, they are rejected on the same basis as claim 13.
7. The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
8. Claims 1-3, 5, 8-10, 13-15, 18, and 20-28 are rejected under 35 U.S.C. 112(a) as failing to comply with the written description requirement. The claims contain subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
As for claims 1, 13, and 20, the specification does not provide sufficient written description or enabling detail for several key claim elements. The omissions rise to a level where a person of ordinary skill in the art could not reasonably conclude that the inventor had full possession of, or could practice, the claimed invention without undue experimentation.
The claims recite specific technical operations such as modifying relative virtual addresses (RVAs) in export tables, registering exception handlers, updating thread contexts, and determining "expected address ranges".
However, the specification merely states that an Address Table Filtering (ATF) module "modifies one or more function-name RVAs to point to a protected or access-restricted memory location" using constants such as PAGE_NOACCESS or mprotect. See for example paragraphs [0014]-[0016).
The claims presume that the ATF module identifies and rewrites function-name RVAs already loaded in a process. However, the Applicant’s Specification never explains how to safely find and write into the Export Address Table (EAT) or Import Address Table (IAT) at runtime. It is common in the art that those tables are mapped read-only, and altering them can corrupt relocation data or break digital-signature validation. The Applicant’s Specification says to modify "one or more function name RVAs", but not whether the module changes the pointer values, marks their containing page PAGE_NOACCESS, or writes dummy addresses to a protected page. Each approach behaves differently. Merely setting PAGE_NOACCESS will cause an access violation. The Specification provides no algorithm or handler logic for determining when to restore access, how to compare instruction pointers, or how to update the thread context. Lastly, the claims cover any computing system, but the spec's mprotect/PAGE_NOACCESS examples are OS-specific and omit equivalent sequences for others.
Claims 2, 3, 5, 8-10 and 21-28 are dependent on claim 1 and do not cure its deficiencies. Therefore, they are rejected on the same basis as claim 1.
Claims 14, 15, and 18 are dependent on claim 13 and do not cure its deficiencies. Therefore, they are rejected on the same basis as claim 13.
Claim Rejections - 35 USC § 101
9. 35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
10. Claims1-3, 5, 8-10, 13-15, 18, and 20-28 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
As for claim 1: the claim recites the following limitations that are abstract ideas that fall into the general groupings of mathematical concepts (mathematical calculations) and mental processes:
Mental Processes (observation in the form of gathering data):
receiving a list of exportable functions accessible to an executing program, the exportable functions each having an exportable function name string;
referencing a relative virtual address (RVA) of one or more of the list of exportable function name strings to an access-restricted memory location
Mathematical Calculations
processing a received exception, the received exception occurring in response to attempted access of the access-restricted memory location,
wherein the processing comprises determining whether a memory address of the received exception is within an expected address range
These limitations merely describe the use of known operating-system functions (e.g., import/export table access, page-protection flags, and standard exception handling) to carry out a logical detection routine.
The specification confirms that each operation is performed using conventional computer components and APIs such as VirtualProtect, mprotect, and routine exception-handler registration. No new data structure, hardware configuration or improvement to memory-management functionality is provided.
The claim therefore falls within the Alice and Electric Power Group line of cases, which hold that collecting, analyzing, and responding to data using standard computing functions constitutes an abstract idea.
Overall, the instant claim is directed to the abstract idea of monitoring and evaluating memory-access behavior.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception because it is not integrated into a practical application. This is because any additional elements such as processors, memory, and exception handler only represent generic computer components performing their ordinary roles without integration into a specific technological improvement.
The claim additionally lacks an inventive concept because the recited elements operate in a conventional manner and merely automate a rule using standard OS mechanisms.
As for dependent claims 2, 3, 5, 8-10, and 21-28, these claims also fail to recite any additional elements that are sufficient to amount to significantly more than the judicial exception. These claims merely recite additional limitations that represent abstract ideas that fall into the groupings of mathematical calculations and mental processes in the form of observation and collection of data. These dependent claims do not integrate the judicial exception into a practical application because, as with claim 1, any additional elements such as processors, memory, and exception handler only represent generic computer components performing their ordinary roles without integration into a specific technological improvement.
These dependent claims also lack an inventive concept because the recited elements operate in a conventional manner and merely automate a rule using standard OS mechanisms.
As for claim 13, this claim is drawn to the method corresponding to the system of claim 1. Claim 13 recites substantially the same limitations as claim 1 and is rejected on the same basis.
As for claims 14, 15, and 18, these claims are dependent on claim 13 and fail to recite any additional elements that are sufficient to amount to significantly more than the judicial exception. These claims merely recite additional limitations that represent abstract ideas that fall into the groupings of mathematical calculations and mental processes in the form of observation and collection of data. These dependent claims do not integrate the judicial exception into a practical application because, as with claim 13, any additional elements only represent generic computer components performing their ordinary roles without integration into a specific technological improvement.
As for claim 20, this claim is drawn to computer-readable storage device storing computer executable instructions that correspond to the system of claim 1. Claim 20 recites substantially the same limitations as claim 1 and is rejected on the same basis.
Conclusion
11. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Paul E. Callahan whose telephone number is (571) 272-3869. The examiner presently works a part-time schedule and can normally be reached from 9am to 5pm on the first Monday and Tuesday and the second Thursday and Friday of the USPTO bi-week schedule.
The examiner’s email address is: Paul.Callahan1@USPTO.GOV
If attempts to reach the examiner by telephone are unsuccessful, the Examiner's supervisor, Alexander Lagor, can be reached on (571) 270-5143. The fax phone number for the organization where this application or proceeding is assigned is: (571) 273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/PAUL E CALLAHAN/Examiner, Art Unit 2437