JNI Hooking Framework for Windows Universal Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Bytecode runtime environments face challenges in injecting hooks into native code executed outside the runtime environment, limiting augmentation, instrumentation, and modification capabilities for debugging, malware analysis, and security purposes.
Innovation Solution
A system for hooking Java Native Interface (JNI) calls from native code to Java code within a Java Virtual Machine (JVM) is developed, utilizing a JNI dynamic hook to intercept calls and a hooking framework that modifies the import address table to load target DLLs, enabling dynamic and static hooking of Windows Universal applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If bytecode is used for cross-platform execution, then portability is improved, but the ability to inject hooks into native code is lost
Solution Approach 1:
The patent introduces a hooking framework that acts as an intermediary layer between the bytecode runtime environment and native code. This framework includes a native library injector that injects hooked native libraries into the native code execution process, allowing hooks to be inserted without modifying the bytecode itself. The intermediary framework enables cross-platform hooking by working at the native code level while the bytecode runtime maintains its portability benefits.
2Speed
If native code is used for execution, then execution speed is improved, but portability across different processors is worsened
Solution Approach 1:
The patent segments the software into two distinct parts: bytecode components that provide portability and native code components that provide execution speed. The hooking framework specifically targets the native code segments, allowing hooks to be injected into performance-critical native functions while the overall application maintains portability through its bytecode architecture. This segmentation enables selective optimization without sacrificing cross-platform capability.
3Difficulty of detecting and measuring
If hooks are injected into native code, then debugging and analysis capability is improved, but system complexity is worsened
Solution Approach 1:
The patent implements preliminary action by pre-compiling hooked versions of native libraries and preparing the hooking framework before the target application runs. The native library injector is configured in advance with the necessary hooked libraries and injection parameters. This preliminary preparation reduces the complexity during runtime, as the actual hooking process becomes a straightforward injection operation rather than requiring complex runtime manipulation of native code.
Data Source
AI summary
Described embodiments provide systems and methods for augmentation, instrumentation, and other runtime modifications of bytecode-based applications through introduction of static and dynamic hooks. In at least one aspect, described is a system for hooking Java native interface calls from native code to Java code in a Java virtual machine. In at least one aspect, described is a system for static hooking of a Windows Universal application. In at least one aspect, described is a system for dynamically hooking a Windows Universal application.