Application Module Injection via OS Callback Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for injecting a specific function module into a process corresponding to an application program are limited by time and OS situation, requiring separate agents and being incompatible with certain OS versions like Vista and Windows 7, especially when dealing with imperative execution programs or multi-core processors.
Innovation Solution
An application module injection device that registers callback functions with the OS to receive process creation and image load notifications, determines the target process, changes the thread context entry point, and injects the module, allowing for predictable and stable injection across various OS situations without a separate user mode agent.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional injection methods (registry, window hooking, remote thread, kernel callback) are used, then injection can be performed in certain OS situations, but the methods are limited by OS version, execution program type, and timing, requiring separate remedies for each case
Solution Approach 1:
The patent implements a universal injection mechanism through the `nt!ObRegisterCallbacks` function that can handle multiple injection scenarios (registry, window hooking, remote thread, kernel callback) through a single unified interface. This callback registration system provides multi-functional capability to detect and inject into processes regardless of OS version or execution program type, eliminating the need for separate remedies for each injection case.
2Reliability
If a separate user mode agent is used for injection, then injection can be performed with user consent, but the agent cannot operate simultaneously during Windows booting and conflicts with existing injection methods
Solution Approach 1:
The patent performs injection actions in advance by registering callbacks with `nt!ObRegisterCallbacks` during kernel initialization, before user mode agents can operate. This preliminary registration enables the system to detect process creation and perform injection automatically at the earliest possible moment, eliminating the timing conflicts that occur when user mode agents try to operate simultaneously during Windows booting.
3Adaptability or versatility
If injection is performed at unpredictable times, then injection can occur in various OS situations, but the injection point cannot be predicted making the process unreliable
Solution Approach 1:
The patent implements a feedback mechanism through registered callbacks that provide real-time notifications about process creation events. The `nt!ObRegisterCallbacks` function establishes a feedback loop where the system notifies the injection mechanism whenever a new process is created, allowing the injection to occur at predictable, well-defined moments rather than at unpredictable times. This feedback ensures both adaptability to various OS situations and reliability through predictable injection timing.
Data Source
AI summary
Provided are an application module injection device, a computing device including an application module injection function, and a recording medium that records a program for executing an application module injection method. The application module injection device includes a function registration unit configured to register, in an operating system (OS), a first callback function for receiving a notice about whether a process corresponding to a program whose execution is instructed by a user is created from the OS and a second callback function for receiving a notice about whether an image corresponding to the program whose execution is instructed by the user is driven, a process information acquisition unit configured to receive the notice about whether the process corresponding to the program whose execution is instructed by the user is created from the OS through the first callback function, a process determination unit configured to select a process generated so as to correspond to the program whose execution is instructed by the user as an application module injection target process when the program whose execution is instructed by the user, which is determined through the second callback function, corresponds to a predetermined type of program, a context change unit configured to change a first entry point included in a context of a thread corresponding to the application module injection target process into a second entry point of an injected application module, and an application module injection unit configured to inject the application module into the application module injection target process.