Configurable and integratable Hook system in Windows environment and method thereof

Abstract

The invention discloses a configurable and integratable Hook system in Windows environment and a method thereof and relates to the technical field of DLL injection technology, Hook technology and interprocess communication. The system is characterized in that an application program subsystem comprises an injector unit and a hook unit, the injector unit comprises an injection module and a communication module, the hook unit comprises an inline hook module, an import address table hook module and a vectored exception handling module, and the injection module, the hook unit, an injected hook unitand the communication module sequentially interact. The method includes: 1, creating a naming pipeline; 2, selecting a target process; 3, selecting a dynamic link library for injection; 4, selectingan injection mode; 5, feeding back injection information; 6, configuring Hook parameters; 7, transmitting the Hook parameters to the injected hook unit; 8, completing Hook functional procedure; 9, feeding back Hook information. The system is configurable, and related process parameters of Hook can be configured by a user; the system has the characteristic of being easy to operate and can help to intercept and acquire enough useful information.

Description

technical field [0001] The invention relates to the technical fields of DLL injection technology, Hook technology and inter-process communication, in particular to a configurable and integrated Hook system and a method thereof under the Windows environment. Background technique [0002] Hook technology is a low-level and meticulous security technology. From the perspective of security defense, today's common security guards and computer housekeepers and other application products are linked to many kernel hooks at the bottom layer of the operating system kernel to monitor many kernel functions. Calling has an inseparable relationship with the application of Hook technology. [0003] From the perspective of attack, Hook technology modifies the execution flow and enforces the characteristics of custom function process, which is used by many malicious software (such as Trojan horses, plug-ins, etc.). [0004] However, the use of Hook technology requires a variety of other tech...

AI Technical Summary

Problems solved by technology

[0004] However, the use of Hook technology requires a variety of other technologies as support, such as DLL injection technology, inter-process communication technology, etc. These technologies and processes are very cumbersome and difficult for ordinary technicians to master

Images