Chained Hook Function Serving Multiple Versions Of Identically Named Dynamically Loaded Libraries

Abstract

A hooking system for hooking predetermined references to predetermined dynamically loaded library (DLL) functions includes a DLL version identifier provided by a hook entry code to an enhanced hook. The hook entry code is dynamically generated during runtime of an affected software application. The version identifier enables unambiguous communication of a single enhanced hook with functions of multiple versions of identically named DLLs loaded into the same isolated process memory area.

Description

FIELD OF INVENTION [0001] The present invention relates to hook functions for runtime interception and redirection of a function call in a code executing computing environment. In particular, the present invention relates to a single hook function intercepting and redirecting function calls to multiple versions of a distinct dynamically loaded library (DLL). BACKGROUND OF INVENTION [0002] A code executing computing environment commonly referred to as system may include among other components an operating system, applications, and dynamically loaded libraries (DLLs) as are well known in the art. A number of functions commonly combined within standardized interfaces contribute to the system's overall behavior. To alter the behavior of a system functions such as for file input-output, prior art applications may reroute execution through well known hook functions or plainly called hooks. In a conventional hook, an application may invoke an original DLL function by utilizing the standard...

AI Technical Summary

Benefits of technology

[0007] Identification of relevant references may be attempted during an initial screening of the DLLs initially loaded at execution begin of the software application. Identification of relevant references may also be attempted during a continuous screening of DLLs loaded at runtime of the software application. In case a relevant reference is identified, hook entry code is dynamically generated. The dynamically generated hook entry code includes generated CPU instructions, which perform the following operations. In a first step, a return address of the relevant function is pushed onto a first stack location of a well known stack of the code executing computing system within which the software application is executing

Problems solved by technology

The inventor observed occasional and somewhat unpredictable failure of prior art hooks and discovered that such prior art hook failure was related to hooks directing execution to incorrect destination addresses when multiple versions of identically named DLLs were simultaneously loaded into well known isolated process memory areas.

In the case where updated versions of ide

Images