DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The instant application having application No. 18/528,921 filed on December 5, 2023, presents claims 1-20 for examination, claims foreign priority to PCT/CN2023/117269, filed on 9/6/2023.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 12/5/2023 was filed before the mailing date of the Non-Final Office Action. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Examiner Notes
Examiner cites particular columns, paragraphs, figures and line numbers in the references as applied to the claims below for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant fully consider the references in their entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Specification
The disclosure is objected to because of the following informalities:
Page 15, paragraph 4, -kernel space component that monitors-.
Appropriate correction is required.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 16-17 are rejected under 35 U.S.C. 102 (a) (1) as being anticipated by Yeap et al. (US 20060282827 A1, hereinafter, “Yeap”).
With respect to claim 16, Yeap anticipates An apparatus for a computer system, the apparatus comprising memory circuitry, machine-readable instructions, and processor circuitry to execute the machine-readable instructions to (e.g. Fig. 1):
intercept, by a kernel system call handler, a kernel system call having been made by a target application having been launched by a loader application (e.g. para [0027], “The kernel hook can be used to monitor the kernel for any incoming calls to begin a new process (step 204). .... Once a call to create a process has been received by the kernel (step 205), the kernel can then direct the operating system to create a new process by causing the loader (e.g., loader 122) to create a new process (step 210). Additionally, upon detection of the call, the kernel hook can notify the hook module that a call (e.g., create process) has been detected and provide for the injection of a file into the process (step 208). ….” Wherein the hook module reads on a kernel system call handler); and
provide, by the kernel system call handler, information on the kernel system call having been made by the target application to the loader application (e.g. para [0027], “.... Once a call to create a process has been received by the kernel (step 205), the kernel can then direct the operating system to create a new process by causing the loader (e.g., loader 122) to create a new process (step 210). Additionally, upon detection of the call, the kernel hook can notify the hook module that a call (e.g., create process) has been detected and provide for the injection of a file into the process (step 208). In one implementation, the kernel hook provides for an interception of the loader such that the loader can be used to inject the file into the process.” Wherein the hook module reads on a kernel system call handler).
With respect to claim 17, Yeap anticipates wherein the kernel system call handler is triggered by a call hook installed in a kernel being executed by the computer system (e.g. para [0027], “The kernel hook can be used to monitor the kernel for any incoming calls to begin a new process (step 204). .... Once a call to create a process has been received by the kernel (step 205), the kernel can then direct the operating system to create a new process by causing the loader (e.g., loader 122) to create a new process (step 210). Additionally, upon detection of the call, the kernel hook can notify the hook module that a call (e.g., create process) has been detected and provide for the injection of a file into the process (step 208). In one implementation, the kernel hook provides for an interception of the loader such that the loader can be used to inject the file into the process.” Wherein the kernel hook reads on a call kernel installed in a kernel, and the hook module reads on the kernel system call handler).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-15, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Yeap et al. (US 20060282827 A1, hereinafter, “Yeap”) in view of Zhou et al (US 20150212832 A1, hereinafter, “Zhou”).
With respect to claim 1, Yeap teaches An apparatus for a computer system, the apparatus comprising memory circuitry, machine-readable instructions, and processor circuitry to execute the machine-readable instructions to (e.g. Fig. 1):
launch, using a loader application, a target application (e.g. para [0027], “… For example, a user can select an executable file that causes the operating system (e.g., operating system 102) to begin a new process. The new process can be used to run a program (e.g., a program from Applications 103) such as a word processor or spreadsheet program. By executing the program, a system call to create a new process can be sent to the kernel (e.g., a "CreateProcess" call) in order to cause the operating system to initiate a new process. Once a call to create a process has been received by the kernel (step 205), the kernel can then direct the operating system to create a new process by causing the loader (e.g., loader 122) to create a new process (step 210). …”);
obtain, by the loader application, information on a kernel system call having been made by the target application (e.g. para [0027], “The kernel hook can be used to monitor the kernel for any incoming calls to begin a new process (step 204). Alternatively, the hook can be configured to monitor only for specific types of new processes. …Additionally, upon detection of the call, the kernel hook can notify the hook module that a call (e.g., create process) has been detected and provide for the injection of a file into the process (step 208). In one implementation, the kernel hook provides for an interception of the loader such that the loader can be used to inject the file into the process.”); and
Yeap does not appear to explicitly disclose
modify, by the loader application and based on the information on the kernel system call having been made by the target application, an instruction of the target application, wherein the modified instruction is configured to trigger an operation being equivalent to the kernel system call, with the operation being equivalent to the kernel system call while avoiding a context switch.
However, this is taught in analogous art, Zhou (e.g. para [0065], “… The generated function or operation may call and the kernel control operation may be initiated with the process ID of the user process of the redirected device driver function or operation and the redirected device driver function or operation user space address as parameters at block 402.” para [0066], “In some embodiments, the execution environment, in the user space, may be configured to execute the redirected device driver function or operation at block 404 by utilizing the environment configuration and control module 220. …” para [0067], “… However, if the redirected device driver function or operation is in a process context the driver function or operation is initiated in the user space at block 410.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the invention of Yeap with the invention of Zhou because it provides techniques for dynamically redirecting device driver functions from the kernel space to a user process in the user space which facilitates and may save time for software development. A person having ordinary skill in the art would have been motivated to make this combination, with a reasonable expectation of success, for the purpose of providing techniques for dynamically redirecting device driver functions from the kernel space to a user process in the user space which facilitates and may save time for software development as suggested by Zhou (see para [0003, 0016]).
With respect to claim 2, Zhou teaches wherein, after modification of the target application, the modified instruction is used by the target application instead of an original instruction of the target application being modified by the modification (e.g. para [0067], “… However, if the redirected device driver function or operation is in a process context the driver function or operation is initiated in the user space at block 410.” For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 3, Zhou teaches wherein the processor circuitry is to execute the machine-readable instructions to use, by the target application, the modified instruction instead of the original instruction of the target application being modified by the modification (e.g. para [0067], “… However, if the redirected device driver function or operation is in a process context the driver function or operation is initiated in the user space at block 410.” For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 4, Yeap teaches wherein an original instruction of the target application being modified by the modification is part of a library being statically linked by the target application (e.g. para [0011], “… The invention can be implemented to realize one or more of the following advantages. An operating system loader can be modified to insert a hook DLL into a process during initialization. The operating system loader can view the inserted hook DLL as statically linked to the process. ...”).
With respect to claim 5, Zhou teaches wherein the instruction is modified by hot-patching the target application (e.g. para [0016], “These and other issues can be solved by dynamically redirecting device driver functions from the kernel space to a user process in the user space. ...” wherein dynamically redirecting reads on hot-patching. For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 6, Zhou teaches wherein the instruction is modified in the launched instance of the target application (e.g. para [0016], “These and other issues can be solved by dynamically redirecting device driver functions from the kernel space to a user process in the user space. ...” wherein dynamically redirecting indicates that the instruction is modified in the launched instance of the target application. For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 7, Yeap teaches wherein the modified instruction launches an operation provided by a user-space library (e.g. para [0011], “The invention can be implemented to realize one or more of the following advantages. An operating system loader can be modified to insert a hook DLL into a process during initialization. The operating system loader can view the inserted hook DLL as statically linked to the process. …” wherein a hook DLL reads on a user-space library).
With respect to claim 8, Zhou teaches wherein the operation being equivalent to the kernel system call is based on a kernel bypass mechanism (e.g. para [0016], “These and other issues can be solved by dynamically redirecting device driver functions from the kernel space to a user process in the user space. ...” wherein dynamically redirecting indicates a kernel bypass mechanism. For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 9, Yeap teaches wherein the information on the kernel system call having been made by the target application is obtained from a kernel system call handler (e.g. para [0027], “The kernel hook can be used to monitor the kernel for any incoming calls to begin a new process (step 204). Alternatively, the hook can be configured to monitor only for specific types of new processes. …Additionally, upon detection of the call, the kernel hook can notify the hook module that a call (e.g., create process) has been detected and provide for the injection of a file into the process (step 208). In one implementation, the kernel hook provides for an interception of the loader such that the loader can be used to inject the file into the process.” Wherein the hook module reads on a kernel system call handler).
With respect to claim 10, Zhou teaches wherein the information on the kernel system call having been made by the target application comprises a context of the kernel system call, with the modification of the instruction being based on the context of the kernel system call (e.g. para [0040], “… More particularly, the kernel space control module 206 include a kernel control operation that may assist in the configuring the execution environment including storing registers in memory to recover the execution environment, determine the context the in which the redirected device driver function or operation is processing in, and process actions from the interrupt handler module 208. ...” For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 11, Zhou teaches wherein the processor circuitry is to execute the machine-readable instructions to determine a position of the instruction to be modified in memory based on the context of the kernel system call (e.g. para [0061], “At block 315, the beginning instructions of the original binary file in the kernel space may be saved in memory and changed to instructions to jump to or call the generated function or operation of block 310. For example, the instructions may be changed to a jump (JMP) command. ...” For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 12, Yeap teaches wherein the target application is launched such that the target application shares an address space with the loader application (e.g. para [0022], “… The memory manager also manages address spaces in main memory (e.g., memory 110) for processes to run. The address space for a process is a list of memory locations with some minimum and maximum to which the process can read and write. The kernel 114 includes a loader 122 that can initiate and run a new process. ...”).
With respect to claim 13, Yeap teaches wherein the processor circuitry is to execute the machine-readable instructions to intercept, by a kernel system call handler, the kernel system call having been made by the target application, and provide, by the kernel system call handler, the information on the kernel system call having been made by the target application to the loader application (e.g. para [0027], “The kernel hook can be used to monitor the kernel for any incoming calls to begin a new process (step 204). .... Once a call to create a process has been received by the kernel (step 205), the kernel can then direct the operating system to create a new process by causing the loader (e.g., loader 122) to create a new process (step 210). Additionally, upon detection of the call, the kernel hook can notify the hook module that a call (e.g., create process) has been detected and provide for the injection of a file into the process (step 208). In one implementation, the kernel hook provides for an interception of the loader such that the loader can be used to inject the file into the process.”).
With respect to claim 14, Yeap teaches wherein the kernel system call handler is triggered by a call hook installed in a kernel being executed by the computer system (e.g. para [0027], “The kernel hook can be used to monitor the kernel for any incoming calls to begin a new process (step 204). .... Once a call to create a process has been received by the kernel (step 205), the kernel can then direct the operating system to create a new process by causing the loader (e.g., loader 122) to create a new process (step 210). Additionally, upon detection of the call, the kernel hook can notify the hook module that a call (e.g., create process) has been detected and provide for the injection of a file into the process (step 208). In one implementation, the kernel hook provides for an interception of the loader such that the loader can be used to inject the file into the process.” Wherein the kernel hook reads on a call kernel installed in a kernel, and the hook module reads on the kernel system call handler).
With respect to claim 15, Zhou teaches wherein the processor circuitry is to execute the machine-readable instruction to determine, based on the intercepted system call, a context of the kernel system call, and to provide the information on the kernel system call having been made by the target application with information on the context of the kernel system call (e.g. para [0040], “… More particularly, the kernel space control module 206 include a kernel control operation that may assist in the configuring the execution environment including storing registers in memory to recover the execution environment, determine the context the in which the redirected device driver function or operation is processing in, and process actions from the interrupt handler module 208. ...” For motivation to combine, please refer to office action regarding claim 1).
With respect to claim 18, it recites same features as claim 15, and is rejected for the same reason.
With respect to claim 19, it is directed to a method that is disclosed in claim 1, please see the rejections directed to claim 1 above which also cover the limitations recited in claim 19.
With respect to claim 20, it is directed to A non-transitory, computer-readable medium to implement the method disclosed in claim 19, please see the rejections directed to claim 19 above which also cover the limitations recited in claim 19. Note that, Yeap discloses A non-transitory, computer-readable medium comprising a program code that, when the program code is executed on a processor, a computer, or a programmable hardware component, causes the processor, computer, or programmable hardware component to perform the method of claim 19 (e.g. Fig. 1)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. For example, Iwamura et al. US 6715051 B2 teaches Program Modification Device.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Zengpu Wei whose telephone number is 571-270-1302. The examiner can normally be reached on Monday to Friday from 8:00AM to 5:00 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sam Sough, can be reached on 5712726799. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://portal.uspto.gov/external/portal. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
/Zengpu Wei/
Examiner, Art Unit 2192
