Abstract: A system and method for identity decisions and invalidation. Modified objects (e.g., files, executables, etc.) are flagged for reevaluation. Privileges associated with the object are only persisted if the modifications are determined to be authorized (e.g., updates and patches). In one embodiment, a tagging system registers to be notified of all writes, renames, truncations, moves, deletions, or any other relevant modifications to objects. If the tagging system detects a modification operation targeting the object, it invalidates all identity decisions cached with the object. The next time the object runs, the system does not recognize the object and it is forced to reevaluate its identity. Thus, patching and other write operations are still permitted, but the system detects the changed object and reevaluates the identity.

Abstract: The present invention is directed to improving the usage of kernel mode memory in computing environments. The invention is useful in offsetting the effects of abandonment of kernel mode memory objects. Objects in kernel mode memory space are identified and a determination is made whether all references to particular kernel objects are known by examining an object container referring to each kernel object. If all references to a kernel object are known, a determination is made whether the kernel object should be classified as a moveable object. Kernel objects classified as movable are retrievably moved to a new memory location and all references to the kernel object are updated to the new memory location. Retrievably moving kernel objects allows abandoned kernel objects to be readily detected.

Abstract: The present invention is directed to improving the usage of kernel mode memory in computing environments. The invention is useful in offsetting the effects of abandonment of kernel mode memory objects. Objects in kernel mode memory space are identified and a determination is made whether all references to particular kernel objects are known by examining an object container referring to each kernel object. If all references to a kernel object are known, a determination is made whether the kernel object should be classified as a moveable object. Kernel objects classified as movable are retrievably moved to a new memory location and all references to the kernel object are updated to the new memory location. Retrievably moving kernel objects allows abandoned kernel objects to be readily detected.

Abstract: The present invention is directed to improving the usage of kernel mode memory in computing environments. The invention is useful in offsetting the effects of abandonment of kernel mode memory objects. Objects in kernel mode memory space are identified and a determination is made whether all references to particular kernel objects are known by examining an object container referring to each kernel object. If all references to a kernel object are known, a determination is made whether the kernel object should be classified as a moveable object. Kernel objects classified as movable are retrievably moved to a new memory location and all references to the kernel object are updated to the new memory location. Retrievably moving kernel objects allows abandoned kernel objects to be readily detected.

Abstract: A system and method for automatically updating software components on a running computer system without requiring any interruption of service. A software module is hotpatched by loading a patch into memory and modifying an instruction in the original module to jump to the patch. A coldpatching technique places a coldpatch version of the module on disk for subsequent loading by processes, after hotpatching occurred. The coldpatch has the entry points to its functions at the same relative locations within the module as the hotpatch, which facilitates subsequent hotpatching. A hotpatch and coldpatch are automatically generated by deriving differences between changed and original binary files, and establishing the point to insert the jump. Validation is performed to ensure that the hotpatch is applied to the correct version, and that the coldpatch is replacing the correct version. Version management is also provided to control the number of patches via support rules.