Abstract: File descriptors associated with specific file types are disambiguated from other file descriptors by maintaining and examining an indicator table containing indicators concerning file descriptors associated with a specific, desired file type. System calls that establish a descriptor of the specific, desired type are intercepted, and an indicator concerning the established file descriptor is added to the indicator table. To keep the indicator table current, system calls that make a copy of a file descriptor or that delete a file descriptor are intercepted. If a file descriptor associated with the desired type is copied or deleted, the indicator table is updated. Therefore, the indicator table preferably includes indicators concerning all file descriptors associated with files of the specific desired type. The indicator table is examined to determine whether or not a specific file descriptor is of the desired type.

Abstract: System calls are selectively intercepted by processes. Processes selected to intercept system calls are loaded by a modified loader program which creates an association between the process and a system call wrapper. Pointers in the interrupt vector table to system calls to be intercepted are replaced with pointers to an interception module in operating system address space. When system calls are made, the interception module executes and determines whether the process that made the system call is a selected process, associated with a system call wrapper. If the process is a selected process, the system call wrapper executes. If the process is not a selected process, the system call is made. In one embodiment, system call wrappers execute in the process address space of selected processes. In another embodiment, system call wrappers execute in user address space, but not in the process address space of any specific processes.