CODE INJECTION AND CODE INTERCEPTION IN AN OPERATING SYSTEM WITH MULTIPLE SUBSYSTEM ENVIRONMENTS

• US 20120233612A1
• Filed: 02/08/2012
• Published: 09/13/2012
• Est. Priority Date: 02/08/2011
• Status: Active Grant

• Current Assignee: Pegasystems Incorporated
• Original Assignee: Pegasystems Incorporated
• Inventors: Beckett, Stephen M.
• Granted Patent: US 9,678,747 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 8/443 Optimisation
• CPC Class Codes: G06F 8/447 Target code generation
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly
• CPC Class Codes: G06F 8/76 Adapting program code to run in a different environment; Porting
• CPC Class Codes: G06F 9/45516 Runtime code conversion or optimisation
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services

Abstract

Systems, methods, and apparatuses are provided for code injection and code interception in an operating systems having multiple subsystem environments. Code injection into a target process can rely on generation of a virtual process that can permit analysis of information loaded in a memory image of the target process regardless of the host environment in which the target process is executed. Based at least on information collected via the analysis, code can be injected into the target process while preserving integrity of the target process. Code interception also can exploit the analysis for suitable hooking that preserves integrity of target process. Code interception can utilize relocatable tokenized code that can be parameterized through token replacement.

Claims

1. A method, comprising:

Creating, by a computing device, a virtual process associated with a target process;

Analyzing, by the computing device, the virtual process; and

Injecting, by the computing device, a first portion of code into the target process based at least on an outcome of the analyzing action.

2. The method of claim 1, further comprising intercepting, by the computing device, a second portion of code based at least on an outcome of the analyzing action.

3. The method of claim 1, further comprising providing, by the computing device, an application programming interface (API) configured to interact with the virtual process, the API comprising at least one instruction object.

4. The method of claim 1, wherein the creating action comprises creating the virtual process associated with the target process during initialization of the target process.

6. The method of claim 1, wherein the creating action comprises loading a module into a memory space from a memory image of the target process.

7. The method of claim 1, wherein the creating action comprises generating a memory map of at least one base allocation of the target process.

8. The method of claim 1, wherein the creating action comprises loading a plurality of modules, at least two modules of the plurality of modules having disparate executable file formats.

9. The method of claim 6, wherein the analyzing action comprises querying a module of the plurality of modules via an application programming interface (API) comprising at least one instruction object.

10. The method of claim 1, wherein the analyzing action comprises determining compatibility of the first portion of code with the target process.

11. The method of claim 1, wherein the analyzing action comprises identifying, by applying a disassembly function call to a first function call, a second functional call nested in the first function call.

12. The method of claim 2, wherein the analyzing action comprises determining validity of a memory address intended for intercepting the second portion of code.

13. The method of claim 1, wherein the analyzing action comprises:

identifying a base address for a module in the virtual process; and

determining if a code interception associated with the module and the base address is present.

14. The method of claim 13, wherein the analyzing action further comprises loading a version of the module without the code interception in response to the determining action indicating that the code interception is present.

15. The method of claim 14, wherein the analyzing further comprises identifying an inner function call of the module in the virtual process and a relative virtual address (RVA) of the inner functional call by applying at least one disassembly function call to the clean version of the module without the code interception, the at least one disassembly function call having a queryable function.

16. The method of claim 1, wherein the injecting action comprises injecting code after a kernel library is loaded and before a module associated with the target process is loaded.

17. The method of claim 2, wherein the analyzing action comprises probing validity of a memory address intended for intercepting the second portion of code.

18. The method of claim 2, wherein the analyzing action comprises determining a collision likelihood for the second portion of code with a disparate portion of code.

19. The method of claim 2, wherein the analyzing action comprises determining compatibility of the second portion of code with the target process.

20. The method of claim 1, wherein intercepting action comprises replacing a token.

21. The method of claim 20, wherein the replacing the token comprises:

allocating memory, in the target process, for at least one or more of a code buffer associated with a first portion of the code or data associated with a second portion of the code;

calculating data values via an allocated base address of the allocated memory; and

replacing an operand associated with the token via a tokenizing API, the operand being further associated with a function address or a data address.

5. The method of claim 5, wherein the loading action comprises loading a dynamic link library of relocatable parameterized code.

23. An apparatus, comprising:

a memory having computer-executable instructions encoded thereon; and

a processor functionally coupled to the memory and configured by the computer-executable instructions,

to create a virtual process associated with a target process;

to analyze the virtual process; and

to injecting a first portion of code into the target process based at least on an outcome of the analyzing action.

22. The method of claim 25, wherein replacing the operand associated with the token comprises:

iterating through a portion of code by instruction;

for an instruction having the operand, determining if the instruction matches the token; and

replacing the operand with a predetermined value in response to the determining action indicating the instruction matches the token.

24. The apparatus of claim 23, the processor being further configured to intercept a second portion of code based at least on an outcome of the analyzing action.

25. The apparatus of claim 23, the processor further being further configured to provide an application programming interface (API) configured to interact with the virtual process, the API comprising at least one instruction object.

26. The apparatus of claim 23, the processor being further configured to create the virtual process associated with the target process during initialization of the target process.

27. The apparatus of claim 26, the processor being further configured to load a dynamic link library of relocatable parameterized code.

28. The apparatus of claim 23, the processor being further configured to load a module into a memory space from a memory image of the target process.

29. The apparatus of claim 23, the processor being further configured to generate a memory map of at least one base allocation of the target process.

30. The apparatus of claim 23, the processor being further configured to load a plurality of modules, at least two modules of the plurality of modules having disparate executable file formats.

31. The apparatus of claim 28, the processor being further configured to query a module of the plurality of modules via an application programming interface (API) comprising at least one instruction object.

32. The apparatus of claim 23, the processor being further configured to determine compatibility of the first portion of code with the target process.

33. The apparatus of claim 23, the processor being configured to identify, via application of a disassembly function call to a first function call, a second functional call nested in the first function call.

34. The apparatus of claim 24, the processor being further configured to wherein the analyzing action comprises determining validity of a memory address intended for intercepting the second portion of code.

35. The apparatus of claim 23, the processor being further configured to:

identify a base address for a module in the virtual process; and

determine if a code interception associated with the module and the base address is present.

36. The apparatus of claim 35, the processor being further configured to load a version of the module without the code interception in response to the determining action indicating that the code interception is present.

37. The apparatus of claim 36, the processor being further configured to identify an inner function call of the module in the virtual process and a relative virtual address (RVA) of the inner functional call through application of at least one disassembly function call to the version of the module without the code interception, the at least one disassembly function call having a queryable function.

38. The apparatus of claim 23, the processor being further configured to inject code after a kernel library is loaded and before a module associated with the target process is loaded.

39. The apparatus of claim 24, the processor being further configured to probe validity of a memory address intended for intercepting the second portion of code.

40. The apparatus of claim 24, the processor being configured to determine a collision likelihood for the second portion of code with a disparate portion of code.

41. The apparatus of claim 24, the processor being further configured to determine compatibility of the second portion of code with the target process.

42. The apparatus of claim 23, the processor being further configured to replace a token.

43. The apparatus of claim 42, the processor being further configured to:

allocate memory, in the target process, for at least one or more of a code buffer associated with a first portion of the code or data associated with a second portion of the code;

calculate data values via an allocated base address of the allocated memory; and

replace an operand associated with the token via a tokenizing API, the operand being further associated with a function address or a data address.

44. The apparatus of claim 43, the processor being further configured to:

iterate through a portion of code by instruction;

determine, for an instruction having the operand, if the instruction matches the token; and

replace the operand with a predetermined value in response to the determining action indicating the instruction matches the token.