Code injection and code interception in an operating system with multiple subsystem environments
First Claim
1. A method, comprising:
- creating, by a computing device, a virtual process that is a non-executing image of a target process, the non-executing virtual process image comprising computer program instructions and data, the non-executing virtual process image comprising a snapshot of the target process, including data of the target process, at least a portion of software modules of the target process, and a state of the target process, wherein the state of the target process is such that at least one data structure is not initialized;
analyzing, by the computing device, the non-executing virtual process image to determine a corresponding location in the associated target process that includes computer program instructions that will be executed before initialization of the target process is completed, to determine validity of the location, and to determine a collision likelihood at the location, using at least one of a disassembler, memory reading, writing, and allocation analysis, and Process Environment Block analysis, wherein the analyzing comprises determining compatibility of a first portion of code with the target process, the compatibility including at least one of determining that the first portion of code loads modules targeting incompatible platforms and determining that the first portion of code loads modules utilizing differing executable file formats;
injecting, by the computing device, the first portion of code into the target process, at the determined location in the target process if the determined location is valid and collision is not likely, the first portion of code adapted based at least on an outcome of the analyzing action, wherein the first portion of code comprises at least one hook to a code loader; and
loading by the code loader, the at least one module compatible with the target process even though the target process targets an incompatible platform.
3 Assignments
0 Petitions
Accused Products
Abstract
Systems, methods, and apparatuses are provided for code injection and code interception in an operating systems having multiple subsystem environments. Code injection into a target process can rely on generation of a virtual process that can permit analysis of information loaded in a memory image of the target process regardless of the host environment in which the target process is executed. Based at least on information collected via the analysis, code can be injected into the target process while preserving integrity of the target process. Code interception also can exploit the analysis for suitable hooking that preserves integrity of target process. Code interception can utilize relocatable tokenized code that can be parameterized through token replacement.
40 Citations
44 Claims
-
1. A method, comprising:
-
creating, by a computing device, a virtual process that is a non-executing image of a target process, the non-executing virtual process image comprising computer program instructions and data, the non-executing virtual process image comprising a snapshot of the target process, including data of the target process, at least a portion of software modules of the target process, and a state of the target process, wherein the state of the target process is such that at least one data structure is not initialized; analyzing, by the computing device, the non-executing virtual process image to determine a corresponding location in the associated target process that includes computer program instructions that will be executed before initialization of the target process is completed, to determine validity of the location, and to determine a collision likelihood at the location, using at least one of a disassembler, memory reading, writing, and allocation analysis, and Process Environment Block analysis, wherein the analyzing comprises determining compatibility of a first portion of code with the target process, the compatibility including at least one of determining that the first portion of code loads modules targeting incompatible platforms and determining that the first portion of code loads modules utilizing differing executable file formats; injecting, by the computing device, the first portion of code into the target process, at the determined location in the target process if the determined location is valid and collision is not likely, the first portion of code adapted based at least on an outcome of the analyzing action, wherein the first portion of code comprises at least one hook to a code loader; and loading by the code loader, the at least one module compatible with the target process even though the target process targets an incompatible platform. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 43)
-
-
22. An apparatus, comprising:
-
a memory having computer-executable instructions encoded thereon; and a processor functionally coupled to the memory and configured by the computer-executable instructions, to create a virtual process that is a non-executing image of a target process, the non-executing virtual process image comprising computer program instructions and data, the non-executing virtual process image comprising a snapshot of the target process, including data of the target process, at least a portion of software modules of the target process, and a state of the target process, wherein the state of the target process is such that at least one data structure is not initialized; to analyze the non-executing virtual process image to determine a corresponding location in the associated target process that includes computer program instructions that will be executed before initialization of the target process is completed, to determine validity of the location, and to determine a collision likelihood at the location, using at least one of a disassembler, memory reading, writing, and allocation analysis, and Process Environment Block analysis, the processor being further configured to determine compatibility of a first portion of code with the target process, the compatibility including at least one of determining that the first portion of code loads modules targeting incompatible platforms and determining that the first portion of code loads modules utilizing differing executable file formats; to inject the first portion of code into the target process at the determined location in the target process if the determined location is valid and collision is not likely, the first portion of code adapted based at least on an outcome of the analyzing action, wherein the first portion of code comprises at least one hook to a code loader; and loading by the code loader, at least one module compatible with the target process even though the target process targets an incompatible platform. - View Dependent Claims (23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 44)
-
Specification