Runtime Code Hooking

• US 20090249368A1
• Filed: 03/25/2008
• Published: 10/01/2009
• Est. Priority Date: 03/25/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Popa, Marius, Ivanov, Hristo H., Mihai, Daniel S., Fransazov, Mariyan D., Needamangala, Ashwin S.
• Granted Patent: US 8,793,662 B2
• Time in Patent Office: Days
• US Class Current: 719/328
• CPC Class Codes: G06F 11/3644 by instrumenting at runtime
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22
• CPC Class Codes: G06F 8/41 Compilation
• CPC Class Codes: G06F 8/656 while running

Abstract

Runtime code hooking techniques are described in which a place holder instruction within a compiled module is used as an entry point to enable code hooking. A hook function to modify a target function is developed. At runtime, the target function to be modified is located. A place holder instruction within the target function is overwritten with instructions to cause execution of the hook function when the target function is called.

Claims

1. A method comprising:

locating a target function to modify on a computing device, the target function compiled to include a place holder instruction to enable hooking a hook function to the target function;

identifying the hook function to execute when a call is made to the target function; and

overwriting the place holder instruction of the target function with instruction to cause execution of the hook function.

2. The method as recited in claim 1, wherein the locating comprises calling one or more application programming interfaces (APIs) of an operating system of the computing device to receive a memory location of the target function.

3. The method as recited in claim 2, wherein the overwriting comprises calling the one or more application programming interfaces (APIs) of the operating system of the computing device to:

retrieve the target function from the memory location;

identify the place holder instruction in the target function; and

replace the place holder instruction with the instruction to cause execution of the hook function.

4. The method as recited in claim 1, wherein the instruction to cause execution of the hook function is a jump instruction to the hook function.

5. The method as recited in claim 1, wherein the place holder instruction is an initial instruction of the target function.

6. The method as recited in claim 1, wherein the overwriting comprises:

overwriting the place holder instruction with a jump instruction to a plurality of non-operative instructions; and

overwriting of the plurality of non-operative instructions with one or more instructions to jump to the hook function.

7. The method as recited in claim 1, wherein the hook function is configured to test operation of a peripheral device communicatively coupled to the computing device.

8. The method as recited in claim 1, wherein the hook function is configured to test printing functionality provided at least in part through a print subsystem of the computing device.

9. The method as recited in claim 1, wherein the hook function is configured to test interaction of a printer driver with a print subsystem of the computing device.

10. The method as recited in claim 1, wherein the hook function is configured to test interaction of a program application with printing functionality provided to the program application through one or more application programming interfaces APIs of an operating system of the computing device.

11. One or more computer-readable media comprising instructions that are stored thereon and are executable to:

call one or more application programming interfaces (APIs) of an operating system of the computing device to receive a memory location of a target function to be modified on the computing device, the target function compiled to include a place holder instruction to enable hooking of a hook function to the target function; and

overwrite the place holder instruction of the target function with a jump instruction to cause execution of the hook function.

12. One or more computer-readable media as recited in claim 11, wherein the hook function is configured to test printing functionality provided at least in part through a print subsystem of the computing device.

13. One or more computer-readable media as recited in claim 11, wherein the instructions to overwrite further comprise instructions to call the one or more application programming interfaces (APIs) of the operating system of the computing device to cause the place holder instruction to be overwritten with the jump instruction such that the hook function is executed when the target function is called.

14. One or more computer-readable media as recited in claim 11, wherein the target function is a component of a printer driver configured to communicate between the operating system and a printing device communicatively coupled to the computing device to output print data via the printing device.

15. One or more computer-readable media as recited in claim 11, wherein the overwriting occurs at runtime.

16. A computing device comprising:

a processor;

memory storing;

an operating system having a print subsystem;

a hook function configured to modify printing functionality provided at least in part through the print subsystem; and

one or more modules stored in the memory and executable via the processor to;

receive information to identify the hook function and a target function to modify on the computing device with the hook function, the target function compiled to include a place holder instruction to enable the modification;

at runtime, call one or more application programming interfaces (APIs) of the operating system to;

locate the target function; and

overwrite the place holder instruction of the target function with instructions to cause execution of the hook function when the target function is called.

17. A computing device as recited in claim 16, wherein the hook function is configured to test an application programming interface (API) of the print subsystem.

18. A computing device as recited in claim 16, wherein the locating the target function comprises determining an address of the target function in the memory.

19. A computing device as recited in claim 16, wherein the instructions to cause execution of the hook function comprise a jump instruction to the hook function.

20. The method as recited in claim 16, wherein the place holder instruction is an initial instruction of the target function.