API Hooking Detection via Offset Verification and Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting API hooking are prone to false positives and struggle to timely detect hooking when the position of a module loaded into memory is variable, especially with new types of hooking programs or hidden operations.
Innovation Solution
A method and system that generate a unique identification value for executable code or function positions by verifying offsets and executable codes, comparing these values to determine if API hooking has occurred, and clustering identification values from multiple clients to accurately identify hooked modules or functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If API hooking detection is performed by verifying whether a debugger or disassembler is executed or installed, then it is possible to detect some hooking attempts, but false positives occur because the detection is indirect and depends on whether a program capable of attempting API hooking is executed or installed
Solution Approach 1:
The patent replaces indirect detection methods (checking for presence of debugging tools) with direct detection by comparing actual API call addresses against expected addresses. This substitution of detection mechanism eliminates false positives caused by indirect inference, as the system directly verifies whether hooking has occurred by checking if API calls are redirected to unexpected locations.
Solution Approach 2:
The patent introduces an intermediary component (hooking detection module) that compares API call addresses with expected addresses from a database. This intermediary verification layer provides accurate detection without relying on indirect indicators, thereby improving both reliability and measurement precision simultaneously.
2Measurement precision
If API hooking detection is performed based on address value of API function, then direct detection is possible, but it becomes difficult to detect when position of module loaded to memory is variable
Solution Approach 1:
The patent changes the detection parameter from absolute memory addresses to relative offsets within modules. By using offsets (differences between addresses) rather than fixed addresses, the system maintains detection accuracy even when modules are loaded at different memory positions. The hooking detection module calculates offsets between API function addresses and module base addresses, making the detection adaptable to variable loading positions.
3Reliability
If traditional API hooking detection methods are used, then existing hooking programs can be detected, but timely response is not possible when new type of hooking program appears or operation is hidden
Solution Approach 1:
The patent performs preliminary action by establishing a database of expected API function addresses and offsets before runtime detection. The system pre-calculates and stores the correct addresses of API functions relative to their module bases, enabling immediate comparison and detection during execution. This preliminary preparation allows the system to quickly identify any deviations caused by new or hidden hooking programs without requiring time-consuming analysis.
Data Source
AI summary
Disclosed is a hooking detection method and system that may specify position information of a function referenced by an executable module from an outside or provided to the outside or a unique value of an executable code, and may determine application programming interface (API) hooking based on a classification acquired by comparing unique values or by clustering the unique values.