Method and system for seamless integration of preprocessing and postprocessing functions with an existing application program

Abstract

A method for associating file activity of an application with the graphical display of the file on a screen comprises loading by an operating system an executable code of a message monitoring program adapted to monitoring a message sent by an operating system to a document display window. The message monitoring program establishes a system-wide window hook using available operating system API functions associated with one or more functions in a library of the message monitoring program. The message monitoring program library is loaded into the memory space of a newly started application program, the import table of the application is fixed with addresses of functions from the message monitoring program library, and the application's main window function is substituted with a message monitoring program window function.

1 : A method for associating file activity of an application with the graphical display of the file on a screen comprising the steps of: 
 loading by an operating system an executable code of a message monitoring program adapted to monitoring a message sent by an operating system to a document display window;    establishing by the message monitoring program a system-wide window hook using available operating system API functions, said system-wide window hook associated with one or more functions in a library of said message monitoring program;    loading the message monitoring program library into the memory space of an application program, said application having been newly started and having an import table and a newly created window;    fixing the import table of the application with addresses of functions from the message monitoring program library; and    substituting the application's main window function with a message monitoring program window function.    
     
     
         2 : The method of  claim 1 , further comprising creating a key window when an application is started, said key window adapted to receive a message when a file is opened and closed.  
     
     
         3 : The method of  claim 2 , further comprising: 
 sending a message to the key window when a file is opened;    creating a child notify window associated with said file; and    creating a notify window as a child window of a document window associated with said file.    
     
     
         4 : The method of  claim 1 , further comprising: 
 creating a notify window when a document window is created, wherein the notify window is a child window of the document window; and    receiving by the notify window a message from the operating system when the parent document window is activated by either the application program or by action of a user.    
     
     
         5 : The method of  claim 1 , further comprising, upon receipt of a document window destroy message by a document's notify window, checking for the existence of a child notify window associated with a file that was opened in association with said document, and acting upon said associated file before destroying said document window.  
     
     
         6 : The method of  claim 5 , comprising a user of an application specifying one or more rules to the application, each said rule indicating an action to be taken on said associated file before destroying said document window.  
     
     
         7 : The method of  claim 6 , wherein an action includes encrypting said associated file, wherein encrypting comprises: 
 creating a new file containing a template of the same format as said associated file, said new file including a header, wherein said header is not encrypted;    copying to the new file a document summary in readable form;    copying to the new file visual indicia representing that the file is encrypted;    copying encrypted data from the associated file to the new file as a named stream, said encrypted data having a beginning and a length; and    writing a code to a substitute stream to prevent the new file from being written over by a user.    
     
     
         8 : The method of  claim 7 , further comprising the step of including in the header a flag indicative of the type of encryption used on the associated file.  
     
     
         9 : The method of  claim 7 , further comprising the step of including in the header a flag indicative of a handling procedure to be performed on said encrypted file.  
     
     
         10 : The method of  claim 7 , further comprising the step of loading data from the encrypted file into a memory block containing other random data, said memory block having a beginning, wherein an offset from the beginning of the memory block of the data from the encrypted file changes each time the message monitoring program executable code is loaded.  
     
     
         11 : The method of  claim 7 , further comprising the step of including in the header a flag indicative of the length of the encrypted data, and a flag that allows the message monitoring program to search for the beginning of the encrypted data.  
     
     
         12 - 24  (Canceled)  
     
     
         25 : The method of  claim 1 , further comprising monitoring by the message monitoring program window function the creation of a document child window.  
     
     
         26 : A method for intercepting a software call to a function contained in a dynamically linked library comprising the steps of: 
 loading an executable program into memory:    obtaining from an operating system by an intercepting program the address of the executable program;    locating in a header of the executable program a list of libraries and functions called by the executable program;    substituting a function reference in an import table of the executable program with a reference to a function in a library of the intercepting program; and    storing said function reference in an internal memory structure.    
     
     
         27 : The method of  claim 26 , wherein said executable program header includes an import table, further comprising examining the import table in order to locate the list of libraries and functions called by the executable program.  
     
     
         28 : The method of  claim 26 , wherein the function reference is an ordinal number.  
     
     
         29 : The method of  claim 26 , wherein the function reference is a name.  
     
     
         30 : The method of  claim 26 , further comprising 
 obtaining the address of a library, said library including an import table; and    substituting a function reference in the import table of the library with a reference to a function in a library of the intercepting program.    
     
     
         31 : The method of  claim 30 , wherein the library address is obtained from the operating system.  
     
     
         32 : The method of  claim 30 , wherein the library address is obtained from the import table of the executable.  
     
     
         33 : The method of  claim 26 , further comprising replacing the address of an API function in the import table of the executable with the address of a function of the intercepting program, said function having a return value comprising a table of addresses of one or more functions, wherein the intercepting program function inspects the table of addresses returned by the API function and inserts one or more substitute function addresses into the table of addresses.