A virtual serial port implementation method based on hook technology

Abstract

This invention relates to the field of communication technology, specifically to a method for implementing a virtual serial port based on Hook technology. The method includes the following steps: replacing functions of the serial port operation API to open, set, and close the serial port and transmit data over the network; compiling this into a dynamic link library; using the dynamic link library to obtain the addresses of the serial port operation API functions CreateFileW, ReadFile, and WriteFile in the host computer process space; constructing a JMP jump instruction; writing it at the beginning of the target API function to redirect to a custom Hook function during the call; the custom Hook function calls the original API functions as needed; and canceling the Hook writes back the original machine code and restores memory attributes, resulting in a switchable monitoring function. This invention solves the problems of traditional serial port implementations, such as easy conflicts when multiple programs compete for usage, difficulty in flexibly monitoring and debugging serial communication, inability to conveniently simulate specific serial port scenarios, and poor scalability and compatibility with new systems or hardware platforms.

Description

Technical Field

[0001] This invention belongs to the field of communication technology, specifically relating to a method for implementing a virtual serial port based on Hook technology. Background Technology

[0002] In the field of computer communication, serial communication, as a traditional and widely used communication method, plays a crucial role in many scenarios such as industrial control and data acquisition. However, with the increasing complexity of systems and the diversification of application requirements, traditional serial port implementations face numerous challenges. On the one hand, in a multi-tasking, multi-process environment, competition for serial port resources among different programs can lead to conflicts, affecting the stability and reliability of communication. For example, multiple programs simultaneously attempting to open the same serial port for read and write operations may cause data corruption or program crashes. On the other hand, in practical applications, it is often necessary to monitor, debug, or simulate specific scenarios for serial communication. Traditional serial port implementations struggle to flexibly implement these functions and cannot meet developers' needs for in-depth control and customization of serial communication. For example, during development, it is necessary to simulate a serial device sending specific data to test the program's response, which is difficult to achieve efficiently using traditional methods. Furthermore, with the continuous development of software technology, higher demands are placed on the scalability and compatibility of serial communication. Existing serial port implementations may require extensive modifications and adaptations when dealing with new operating system versions or different hardware platforms, increasing development costs and difficulty.

[0003] Existing technologies are not flexible enough in controlling serial communication, making it difficult to achieve real-time monitoring, debugging, and simulation of specific scenarios. They are also prone to conflicts when multiple programs compete for serial port resources, and have poor scalability and compatibility with new systems or hardware platforms, failing to meet diverse application needs. Summary of the Invention

[0004] To address the aforementioned issues, this invention provides a virtual serial port implementation method based on Hook technology. This method solves the problems of traditional serial port implementations, such as easy conflicts when multiple programs compete for usage, difficulty in flexibly monitoring and debugging serial communication, inability to conveniently simulate specific serial port scenarios, and poor scalability and compatibility with new systems or hardware platforms. To achieve the above objectives, this invention adopts the following technical solution: The virtual serial port implementation method based on Hook technology includes the following steps: First, by replacing the serial port operation API function, the functions of opening, setting, and closing the serial port and transmitting data over the network are implemented. This is then compiled into a dynamic link library to obtain a function support library. Second, the addresses of the serial port operation API functions CreateFileW, ReadFile, and WriteFile are obtained from the host computer process space using the dynamic link library to obtain the target function addresses. Third, a suitable API is selected based on the operating system, and the memory page protection attribute of the target API function is modified to be readable, writable, and executable, resulting in a modifiable memory state. Fourth, the first 5-8 bytes of the original machine code of the target API function are read and saved for easy recovery, resulting in a backup of the original machine code. Fifth, a JMP jump instruction is constructed and written to the beginning of the target API function, causing the call to jump to a custom Hook function, resulting in jump settings. Sixth, the replacement function is called in the custom Hook function to implement the opening, reading, writing, interception, and virtual functions of the serial port, resulting in the virtual serial port function implementation. Seventh, the custom Hook function calls the original API function as needed, and when the Hook is canceled, the original machine code is written back and the memory attributes are restored, resulting in a switchable monitoring function.

[0005] Furthermore, the step of replacing functions via the serial port operation API to open, set, and close the serial port and transmit data over the network, compiling them into a dynamic link library to obtain a functional support library, includes the following steps: Programming in standard C / C++ language, through detailed analysis of the actual requirements of serial port operations, designing a function to open the serial port, specifying the name of the serial port to be received and the access mode; setting the serial port function, determining the baud rate and data bit adjustment method; closing the serial port function, specifying the resource release process; and a function for transmitting data over the network, setting the data packaging and transmission protocol; compiling using a compiler to convert the code into a machine-executable binary file, packaging it to generate a dynamic link library, and obtaining a functional support library that can provide actual functional support for the virtual serial port.

[0006] Furthermore, the step of obtaining the serial port operation API function addresses of CreateFileW, ReadFile, and WriteFile in the host computer process space using dynamic link libraries to obtain the target function addresses includes the following steps: Loading the system dynamic link library kernel32.dll using the LoadLibrary function; sequentially extracting the function addresses of the three serial port operation APIs CreateFileW, ReadFile, and WriteFile using the GetProcAddress function; associating and storing the obtained function addresses with their corresponding API names to ensure that the Hook operation can accurately locate the target function entry point; and completing the function call to achieve address extraction in the host computer process space, obtaining the precise memory addresses of the three target API functions.

[0007] Furthermore, the step of selecting a suitable API based on the operating system and modifying the protection attribute of the memory page containing the target API function to be readable, writable, and executable to obtain a modifiable memory state includes the following steps: using the memory protection modification API provided by the operating system, locating the memory page through the address of the target API function; under the Windows system, calling the VirtualProtect function to change the protection attribute of the target memory page to PAGE_EXECUTE_READWRITE to ensure that the page has readable, writable, and executable permissions; calculating the base address and size of the memory page to ensure that the modification range covers the starting position of the target function, the memory state meets the requirements for directly writing jump instructions, recording the original protection attribute value, and obtaining a safe-to-modify memory state.

[0008] Furthermore, the step of reading and saving the first 5-8 bytes of raw machine code of the target API function for easy recovery and obtaining a raw machine code backup includes the following steps: using a memory read function to locate the starting address of the target API function, and extracting the first 5-8 bytes of raw machine code by reading byte by byte; storing the read binary data sequentially into a dedicated buffer to ensure data integrity and no loss; and safely backing up the raw machine code to an independent storage area to form a reusable recovery data source, thereby obtaining a raw machine code backup with complete recovery capabilities.

[0009] Furthermore, the construction of the JMP jump instruction, written at the beginning of the target API function, to redirect the call to the custom Hook function and obtain the jump setting, includes the following steps: using an assembly instruction generation tool, the machine code of the JMP jump instruction is constructed by calculating the relative offset between the address of the target API function and the custom Hook function; the generated jump instruction binary data is written to the starting position of the target API function, overwriting the original starting byte. Before writing, it is necessary to ensure that the memory protection attribute has been modified to a writable state, and after writing, the instruction cache is refreshed; the call to the target API function will be forced to jump to the custom Hook function, forming a complete call interception mechanism and obtaining an effective jump setting.

[0010] Furthermore, the step of calling the replacement function within the custom Hook function to implement serial port opening, reading, and writing interception and virtual functions, thereby achieving a virtual serial port function implementation, includes the following steps: using a custom Hook function as the interception entry point, identifying the serial port operation type through parameter parsing, calling the replacement function to verify the device name, recording the call information, and modifying access permissions; extracting the data buffer for content inspection, format conversion, and encryption processing, and determining whether to call the original API function based on the configuration; and implementing virtual functions such as network data forwarding and log recording through the replacement function to obtain a complete virtual serial port function implementation.

[0011] Furthermore, the custom Hook function calls the original API function on demand. When the Hook is canceled, the original machine code is written back and the memory attributes are restored, resulting in a monitor function that can be switched on and off. This includes the following steps: using a conditional judgment mechanism, the custom Hook function decides whether to call the original API function based on the configuration; when the Hook is canceled, the saved backup of the original machine code is accurately written back to the starting position of the target API function; the system API is called to restore the memory page protection attributes to their initial state, resulting in a monitor function that can be flexibly switched on and off.

[0012] Furthermore, the method of using an assembly instruction generation tool to construct the machine code of the JMP jump instruction by calculating the relative offset between the target API function address and the custom Hook function includes the following steps: analyzing the target API function address using a disassembler and calculating the relative offset between the target API function and the custom Hook function using the memory address difference; parameterizing the relative jump offset of the JMP instruction using an assembly instruction generator to generate the corresponding machine code; ensuring that the instruction length is aligned with the address and that the generated jump instruction conforms to the processor architecture specification, resulting in a binary jump instruction that can be directly written to the beginning of the target API function.

[0013] In the technical solution provided by this invention, serial port operation API replacement functions are used to open, set, and close the serial port and transmit data over the network. These functions are compiled into a dynamic link library to obtain a functional support library. The dynamic link library is used to obtain the addresses of the serial port operation API functions CreateFileW, ReadFile, and WriteFile in the host computer process space, thus obtaining the address of the target function. A suitable API is selected based on the operating system, and the memory page protection attribute of the target API function is modified to be readable, writable, and executable, thus obtaining a modifiable memory state. The first 5-8 bytes of the original machine code of the target API function are read and saved for easy recovery, thus obtaining a backup of the original machine code. A JMP jump instruction is constructed and written to the beginning of the target API function, causing the call to jump to a custom Hook function, thus obtaining jump settings. The replacement function is called in the custom Hook function to implement the opening, reading, and writing of the serial port, interception, and virtual functions, thus obtaining the virtual serial port function implementation. The custom Hook function calls the original API function as needed, and when the Hook is canceled, the original machine code is written back and the memory attributes are restored, thus obtaining a switchable monitoring function. This invention solves the problems of traditional serial port implementation methods, such as easy conflict when multiple programs compete for use, difficulty in flexibly monitoring and debugging serial port communication, inability to conveniently simulate specific serial port scenarios, and poor scalability and compatibility with new systems or hardware platforms. Attached Figure Description

[0014] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0015] Figure 1 This is a schematic diagram of the first embodiment of a virtual serial port implementation method based on Hook technology in this invention.

[0016] Figure 2 This is a schematic diagram of a second embodiment of a virtual serial port implementation method based on Hook technology in this invention.

[0017] Figure 3 This is a schematic diagram of a third embodiment of a virtual serial port implementation method based on Hook technology in this invention.

[0018] Figure 4 This is a schematic diagram of the fourth embodiment of a virtual serial port implementation method based on Hook technology in this invention.

[0019] Figure 5 This is a schematic diagram of the fifth embodiment of a virtual serial port implementation method based on Hook technology in this invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0021] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms “a,” “an,” “the,” and “the” used herein may also include the plural forms. It should be further understood that the term “comprising” as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0022] A method for implementing a virtual serial port based on Hook technology, such as Figure 1As shown, the process includes the following steps: First, by replacing the serial port operation API function, the functions of opening, setting, and closing the serial port and transmitting data over the network are implemented. This is then compiled into a dynamic link library to obtain a functional support library. Second, the addresses of the serial port operation API functions `CreateFileW`, `ReadFile`, and `WriteFile` are obtained from the host computer process space using the dynamic link library to obtain the address of the target function. Third, a suitable API is selected based on the operating system, and the memory page protection attribute of the target API function is modified to be readable, writable, and executable, resulting in a modifiable memory state. Fourth, the first 5-8 bytes of the original machine code of the target API function are read and saved for easy recovery, resulting in a backup of the original machine code. Fifth, a JMP jump instruction is constructed and written to the beginning of the target API function, causing the call to jump to a custom Hook function, resulting in jump settings. Sixth, the replacement function is called within the custom Hook function to implement the opening, reading, and writing of the serial port, interception, and virtual functions, resulting in the virtual serial port function implementation. Finally, the custom Hook function calls the original API function as needed, and when the Hook is canceled, the original machine code is written back and the memory attributes are restored, resulting in a switchable monitoring function.

[0023] like Figure 2 As shown, in this embodiment, standard C / C++ language is used for programming. Through detailed analysis of the actual needs of serial port operation, a function to open the serial port is designed, specifying the name of the serial port to be received and the access mode; a serial port function is set, determining the baud rate and data bit adjustment method; a serial port closing function is defined, specifying the resource release process; and a network data transmission function is defined, setting the data packaging and transmission protocol; the code is compiled using a compiler, converted into a machine-executable binary file, packaged to generate a dynamic link library, resulting in a function support library that can provide actual functional support for the virtual serial port.

[0024] Through standard C / C++ programming, various functions were meticulously designed to meet the needs of serial port operations, covering opening, setting, and closing the serial port, as well as network data transmission. The operational specifications and parameter settings for each step were clearly defined, ensuring the accuracy and stability of serial port operations. A compiler was used to compile and package the code into a dynamic link library, forming a functional support library that provides solid and reliable practical functional support for the virtual serial port, enabling it to run efficiently and stably and effectively meet the serial communication needs of relevant systems.

[0025] like Figure 3As shown, in this embodiment, the LoadLibrary function is used to load the system dynamic link library kernel32.dll, and the GetProcAddress function is used to extract the function addresses of the three serial port operation APIs, CreateFileW, ReadFile, and WriteFile, in sequence. The obtained function addresses are associated with the corresponding API names and stored to ensure that the Hook operation can accurately locate the entry point of the target function. The address extraction is completed in the host computer process space through function calls, and the precise memory addresses of the three target API functions are obtained.

[0026] By employing a specific method to load the system's dynamic link library and extract the addresses of serial port operation API functions, the entry points of the three key serial port operation functions—CreateFileW, ReadFile, and WriteFile—can be accurately located. By associating and storing the function addresses with their API names, a solid foundation is laid for subsequent hooking operations. Address extraction is performed within the host computer process space, ensuring the precise memory addresses of the three target API functions are obtained. This allows for effective interception and modification of serial port operation-related processes, enabling flexible control and monitoring of serial communication and meeting diverse needs for serial data processing in specific scenarios.

[0027] LoadLibrary is a key API function provided by the Windows operating system, located in the kernel32.dll library. Its main function is to dynamically load a specified dynamic link library (DLL) file into the address space of the current process. When this function is called, the system searches for and loads the DLL. If successful, it returns the module handle of the library, which can then be used to access resources within the library. It supports loading by path or searching for and loading in the system's preset paths by filename. Dynamically loading DLLs using LoadLibrary allows for flexible control over when libraries are used, reducing resource consumption at program startup and improving program efficiency and modularity.

[0028] GetProcAddress is an important API function in Windows systems, often used in conjunction with LoadLibrary. After successfully loading a dynamic link library (DLL) via LoadLibrary, GetProcAddress can be used to obtain the address of a specified function from the loaded DLL module. It accepts two parameters: the DLL module handle and the name or ordinal of the function to be searched. After obtaining the function address through this function, the program can dynamically call the function in the DLL at runtime, enabling flexible expansion of functionality and modular programming. This greatly improves code reusability and maintainability, and is widely used in the development of various Windows programs.

[0029] like Figure 4As shown, in this embodiment, the memory protection modification API provided by the operating system is used to locate the memory page through the target API function address; under the Windows system, the VirtualProtect function is called to change the protection attribute of the target memory page to PAGE_EXECUTE_READWRITE to ensure that the page has read, write and execute permissions; the base address and size of the memory page are calculated to ensure that the modification range covers the starting position of the target function and the memory state meets the requirements for directly writing jump instructions; the original protection attribute value is recorded to obtain the memory state that can be safely modified.

[0030] By leveraging operating system memory protection to modify APIs, the target API function's memory page is precisely located. Under Windows, the VirtualProtect function is called to cleverly change the target memory page's protection attribute to PAGE_EXECUTE_READWRITE, granting it read, write, and execute permissions, thus facilitating subsequent operations. By calculating the memory page's base address and size, the modification scope precisely covers the target function's starting position, meeting the requirement for directly writing jump instructions. Simultaneously, the original protection attribute values ​​are recorded to ensure the memory's original state can be restored after the operation, achieving safe and reliable memory modification.

[0031] Specifically, VirtualProtect is a Win32 API function provided by the Windows operating system, encapsulated in Kernel32.dll. It is used to dynamically modify the access protection attributes of committed memory pages in a process's virtual address space. By specifying the target memory base address, region size, new protection attribute flags, and old attribute storage pointers, this function can flexibly adjust memory permissions, supporting various protection types such as read / write, execution, and protected pages. It is primarily used in scenarios such as dynamic code execution and data security protection. It needs to be used in conjunction with VirtualAlloc to allocate memory, providing flexible control over memory operations while ensuring system security.

[0032] like Figure 5 As shown, in this embodiment, a memory read function is used to locate the starting address of the target API function, and the first 5-8 bytes of original machine code are extracted by reading byte by byte. The read binary data is stored sequentially in a dedicated buffer to ensure data integrity and no loss. The original machine code is safely backed up to an independent storage area to form a reusable recovery data source, resulting in a backup of the original machine code with complete recovery capabilities.

[0033] By precisely locating the starting address of the target API function using a memory read function, the first 5-8 bytes of raw machine code are extracted byte by byte, ensuring the accuracy of data extraction. The read binary data is stored in an ordered manner in a dedicated buffer, effectively preventing data loss and ensuring its integrity. Simultaneously, the raw machine code is securely backed up to an independent storage area, forming a reusable recovery data source. This series of operations enables the function to be quickly and accurately restored to its original state based on the backed-up raw machine code after subsequent modifications or monitoring of the target function.

[0034] In this embodiment, an assembly instruction generation tool is used to construct the machine code for the JMP jump instruction by calculating the relative offset between the target API function address and the custom Hook function. The generated jump instruction binary data is written to the starting position of the target API function, overwriting the original starting byte. Before writing, it is necessary to ensure that the memory protection attribute has been modified to a writable state. After writing, the instruction cache is refreshed. Calls to the target API function will be forced to jump to the custom Hook function, forming a complete call interception mechanism and obtaining effective jump settings.

[0035] By leveraging assembly instruction generation tools, the relative offset is accurately calculated, and the JMP jump instruction machine code is constructed, laying the foundation for call interception. The binary data of the jump instruction is written to the starting location of the target API function. While ensuring memory writability, the original bytes are effectively overwritten, and the instruction cache is flushed after writing, ensuring the instruction takes effect promptly. In this way, calls to the target API function are forcibly redirected to a custom Hook function, successfully establishing a complete call interception mechanism. This facilitates the monitoring, modification, or extension of the target function's functionality, meeting diverse software development and system debugging needs.

[0036] A hook function is a technical mechanism used to intercept, modify, or monitor the execution flow of a program. It replaces or inserts custom code to execute pre-defined hook function logic when the system or application calls a specific function, before deciding whether to continue calling the original function. Hook technology is widely used in debugging, security protection, and feature extension scenarios, such as intercepting API calls to log, modifying input / output data, or monitoring keyboard and mouse input. Depending on the location of the hook, it can be divided into code hooks, message hooks, etc., but should be used with caution to avoid compromising program stability or introducing security risks.

[0037] In this embodiment, a custom Hook function is used as the interception entry point. The serial port operation type is identified through parameter parsing, the replacement function is called to verify the device name, the call information is recorded and the access permissions are modified. The data buffer is extracted for content inspection, format conversion and encryption. The original API function is called according to the configuration. The virtual functions of network data forwarding and log recording are implemented through the replacement function, thus obtaining a complete virtual serial port function implementation.

[0038] Using a custom hook function as the interception entry point, it can accurately identify serial port operation types, providing a basis for subsequent targeted processing. Calling the replacement function to verify the device name enhances device access security. Recording call information and modifying permissions facilitates monitoring and management. Data buffer processing includes checking, conversion, and encryption to ensure data quality and security. The ability to flexibly decide whether to call original API functions based on configuration increases system adaptability. By implementing virtual functions such as network data forwarding and logging through the replacement function, a complete virtual serial port function has been successfully constructed.

[0039] In this embodiment, a conditional judgment mechanism is adopted to determine whether to call the original API function in the custom Hook function based on the configuration; when canceling the Hook, the original machine code backup is saved and accurately written back to the starting position of the target API function; the system API is called to restore the memory page protection attribute to the initial state, thus obtaining a monitoring function that can be flexibly switched on and off.

[0040] By leveraging a conditional judgment mechanism, custom hook functions can flexibly decide whether to call the original API function based on configuration, enabling precise control over serial port operation monitoring and meeting the needs of different scenarios. When the hook is canceled, the saved backup of the original machine code is accurately written back to the starting position of the target API function, ensuring that the system function is restored to its original state. At the same time, the system API is called to restore the memory page protection attributes to their initial state, ensuring system security and stability. This series of operations makes the monitoring function flexible to switch on and off, enabling effective monitoring and rapid restoration of normal system operation when needed.

[0041] In this embodiment, a disassembler is used to analyze the address of the target API function, and the relative offset with the custom Hook function is calculated by the memory address difference. An assembler is used to parameterize the relative jump offset of the JMP instruction and generate the corresponding machine code. The instruction length is ensured to be aligned with the address, and the generated jump instruction conforms to the processor architecture specification, resulting in a binary jump instruction that can be directly written into the beginning of the target API function.

[0042] The target API function address is precisely analyzed using disassemblers, providing a reliable foundation for subsequent calculations. Accurate jump positioning is ensured by calculating the relative offset between memory address differences and the custom hook function. An assembler is used to parameterize the relative jump offset of the JMP instruction to generate machine code, improving the flexibility and versatility of instruction generation. Simultaneously, the instruction length is ensured to be aligned with the address, conforming to processor architecture specifications, resulting in binary jump instructions that can be directly written into the beginning of the target API function.

[0043] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for implementing a virtual serial port based on Hook technology, characterized in that, The virtual serial port implementation method based on Hook technology includes the following steps: By replacing functions with serial port operation API functions, the function can be implemented to open, set, and close the serial port and transmit data over the network. This function is then compiled into a dynamic link library to obtain a functional support library. The addresses of the serial port operation API functions CreateFileW, ReadFile, and WriteFile are obtained from the host computer process space using dynamic link libraries, thus obtaining the address of the target function. Select the appropriate API based on the operating system, modify the memory page protection attribute of the target API function to be readable, writable and executable, and obtain the modifiable memory state; Read and save the first 5-8 bytes of raw machine code of the target API function for easy recovery, thus obtaining a backup of the raw machine code; Construct a JMP jump instruction and write it at the beginning of the target API function so that the call will redirect to the custom Hook function, thus obtaining the jump settings; Call the replacement function in the custom Hook function to implement the functions of opening, reading and writing serial ports, intercepting and virtualizing them, thus achieving the virtual serial port function implementation. A custom Hook function calls the original API function on demand. When the Hook is canceled, the original machine code is written back and the memory properties are restored, resulting in a monitoring function that can be turned on or off.

2. The method for implementing a virtual serial port based on Hook technology according to claim 1, characterized in that, The step of replacing functions via the serial port operation API to open, set, and close the serial port and transmit data over the network, compiling them into a dynamic link library to obtain a functional support library, includes the following steps: The program is written in standard C / C++. Through detailed analysis of the actual needs of serial port operation, a function to open the serial port is designed, and the name of the serial port to be received and the access mode are specified. Configure serial port functions, determine the baud rate and data bit adjustment method, close serial port functions, define resource release procedures, and configure network data transmission functions, setting data packetization and transmission protocols; The code is compiled using a compiler, converted into a machine-executable binary file, packaged into a dynamic link library, and thus a function support library that provides actual functional support for the virtual serial port.

3. The method for implementing a virtual serial port based on Hook technology according to claim 1, characterized in that, The process of obtaining the serial port operation API function addresses of CreateFileW, ReadFile, and WriteFile from the host computer process space using dynamic link libraries to obtain the target function address includes the following steps: The system dynamic link library kernel32.dll is loaded using the LoadLibrary function, and the function addresses of the three serial port operation APIs, CreateFileW, ReadFile, and WriteFile, are extracted sequentially using the GetProcAddress function. The obtained function address is associated with the corresponding API name and stored to ensure that the Hook operation can accurately locate the target function entry point; This is accomplished through function calls, where address extraction is performed within the host computer's process space to obtain the precise memory addresses of the three target API functions.

4. The method for implementing a virtual serial port based on Hook technology according to claim 1, characterized in that, The process of selecting a suitable API based on the operating system and modifying the memory page protection attribute of the target API function to be readable, writable, and executable to obtain a modifiable memory state includes the following steps: The memory protection modification API provided by the operating system is used to locate the memory page through the target API function address; In Windows, calling the VirtualProtect function changes the target memory page protection attribute to PAGE_EXECUTE_READWRITE, ensuring that the page has read, write, and execute permissions. Calculate the base address and size of the memory page, ensure that the modification range covers the starting position of the target function, and that the memory state meets the requirements for directly writing jump instructions. Record the original protection attribute values ​​to obtain the memory state that can be safely modified.

5. The method for implementing a virtual serial port based on Hook technology according to claim 1, characterized in that, The process of reading and saving the first 5-8 bytes of the original machine code of the target API function for easy recovery and obtaining a backup of the original machine code includes the following steps: The starting address of the target API function is located using a memory read function, and the first 5-8 bytes of raw machine code are extracted by reading byte by byte. The read binary data is stored sequentially into a dedicated buffer to ensure data integrity and no loss. The original machine code is securely backed up to an independent storage area, forming a reusable recovery data source, resulting in a backup of the original machine code with full recovery capabilities.

6. The method for implementing a virtual serial port based on Hook technology according to claim 1, characterized in that, The process of constructing a JMP jump instruction and writing it at the beginning of the target API function to redirect to a custom Hook function during the call, thereby obtaining the jump settings, includes the following steps: Using an assembly instruction generation tool, the machine code for the JMP jump instruction is constructed by calculating the relative offset between the target API function address and the custom Hook function. Write the generated jump instruction binary data to the starting position of the target API function, overwriting the original starting byte. Before writing, ensure that the memory protection attribute has been modified to a writable state. After writing, refresh the instruction cache. Calls to the target API function will be forcibly redirected to the custom Hook function, forming a complete call interception mechanism and achieving effective redirection settings.

7. The method for implementing a virtual serial port based on Hook technology according to claim 1, characterized in that, The process of calling the replacement function within a custom Hook function to implement serial port opening, reading / writing interception, and virtual functions, thereby achieving the virtual serial port functionality, includes the following steps: A custom Hook function is used as the interception entry point. The serial port operation type is identified by parameter parsing, the replacement function is called to verify the device name, the call information is recorded, and the access permissions are modified. Extract data from the buffer for content inspection, format conversion, and encryption; determine whether to call the original API function based on the configuration. By replacing functions to implement virtual functions for network data forwarding and log recording, a complete virtual serial port function is achieved.

8. The method for implementing a virtual serial port based on Hook technology according to claim 1, characterized in that, The custom Hook function calls the original API function as needed. When the Hook is canceled, the original machine code is written back and the memory attributes are restored, resulting in a switchable monitoring function, including the following steps: A conditional judgment mechanism is adopted to determine whether to call the original API function in the custom Hook function based on the configuration; When the hook is canceled, the original machine code backup is saved and accurately written back to the starting position of the target API function; Calling the system API restores the memory page protection attribute to its initial state, providing a monitoring function that can be flexibly switched on and off.

9. A method for implementing a virtual serial port based on Hook technology according to claim 6, characterized in that, The process of using an assembly instruction generation tool to construct the machine code for the JMP jump instruction by calculating the relative offset between the target API function address and the custom Hook function includes the following steps: The target API function address is analyzed using a disassembler, and the relative offset to the custom Hook function is calculated by using the memory address difference. Using an assembly instruction generator, the relative jump offset of the JMP instruction is parameterized to generate the corresponding machine code; Ensure that the instruction length is aligned with the address, and that the generated jump instructions conform to the processor architecture specifications, resulting in binary jump instructions that can be directly written into the beginning of the target API function.

Images