Hooking Nonexported Functions via Offset Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware protection programs face challenges in monitoring vulnerabilities in nonexported functions within binary executables, as they cannot hook external function calls to these functions, leading to ineffective monitoring and potential false positives.
Innovation Solution
The method involves generating offset data that includes the offset and unique identifier of nonexported functions, allowing the malware protection program to insert hooks at specific memory locations within the binary executable, redirecting code paths to a host protection processor for monitoring and preventing vulnerability exploitation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware protection programs hook function calls to exported functions to monitor vulnerabilities, then monitoring capability for exported functions is improved, but monitoring capability for nonexported functions remains ineffective
Solution Approach 1:
The patent segments the monitoring approach into two distinct methods: traditional function call hooking for exported functions, and offset-based code injection for nonexported functions. This segmentation allows each method to be optimized for its specific target, with the offset-based approach enabling monitoring of nonexported functions by directly injecting hooks at calculated memory offsets rather than relying on function call interception.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a vulnerability detection service that acts as a mediator between the malware protection program and nonexported functions. This service receives offset data, determines the memory location of nonexported functions, and facilitates hook insertion through code injection, enabling indirect monitoring capability where direct function call hooking fails.
2Reliability
If malware protection programs attempt to monitor nonexported functions through exported function hooks, then some monitoring coverage is achieved, but false positives increase due to inability to directly monitor
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing offset data for nonexported functions before vulnerability monitoring begins. The vulnerability detection service determines the offset of nonexported functions and provides this information in advance, allowing the malware protection program to accurately locate and hook these functions without relying on indirect monitoring that causes false positives.
Solution Approach 2:
The patent replaces the mechanical function call hooking mechanism with a direct code injection mechanism at calculated offsets. Instead of relying on the natural flow of function calls to indirectly monitor nonexported functions, the system directly injects monitoring code at the precise memory locations determined by offset data, eliminating the indirectness that causes false positives.
3Productivity
If malware protection programs use traditional function hooking methods, then exported functions are monitored effectively, but nonexported functions cannot be monitored at all
Solution Approach 1:
The patent achieves universality by creating a unified vulnerability monitoring system that handles both exported and nonexported functions through a single integrated approach. The vulnerability detection service serves both function types, and the malware protection program employs a unified architecture that selects the appropriate monitoring method (function hooking for exported functions, offset-based injection for nonexported functions) based on function accessibility, thereby achieving comprehensive coverage without sacrificing efficiency for either type.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for obfuscated malware. In one aspect, a method includes accessing offset data associated with a binary executable, the offset data including an offset of a nonexported function; and modifying instructions at the offset. In another aspect, a method includes analyzing a reference generated for a binary executable, identifying a unique identifier for the binary executable, determining an offset of a nonexported function in the binary executable, and generating offset data that includes the offset and the unique identifier.