Proxy Process for Agent Injection in Statically Linked Binaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing automated agent injection systems are ineffective for statically linked, self-contained binaries as they do not use dynamic loading functionality, which is required for automatic agent injection.
Innovation Solution
The system intercepts system calls dedicated to binary execution, checks if the binary is statically or dynamically linked, and adapts the system call to execute a proxy process instead of the original binary for statically linked binaries. The proxy process loads the binary, transfers its memory image, and instruments it with agent functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If dynamic loading functionality is used for automatic agent injection, then agent injection works for dynamically linked binaries, but it does not work for statically linked binaries
Solution Approach 1:
The patent introduces a proxy process as an intermediary between the kernel loader and the statically linked binary. The proxy process intercepts the binary execution request, loads the binary into memory, and then executes it. This intermediary enables agent injection by creating a controlled environment where the binary can be loaded and executed with monitoring capabilities, resolving the contradiction between simplicity and adaptability.
Solution Approach 2:
The patent performs preliminary actions by intercepting the binary execution request before the actual execution occurs. The system checks whether the binary is statically linked, and if so, spawns a proxy process that prepares the binary for execution. This preliminary interception and preparation enables agent injection to work for statically linked binaries without changing the binaries themselves.
2Productivity
If statically linked binaries are executed directly, then execution is simple and fast, but agent injection is not possible
Solution Approach 1:
The proxy process serves as a mediator that sits between the direct execution path and the monitoring system. It allows the binary to execute with minimal overhead while enabling the monitoring system to observe and instrument the execution. This resolves the contradiction by maintaining execution efficiency while adding monitoring capability through the intermediary layer.
3Adaptability or versatility
If a proxy process is introduced to enable agent injection, then agent injection works for statically linked binaries, but system complexity increases
Solution Approach 1:
The proxy process is designed as a simple intermediary that performs three main functions: intercepting binary execution requests, loading the binary into memory, and executing it. By keeping the proxy process architecture simple and focused on these core functions, the patent minimizes the increase in system complexity while achieving agent injection capability for statically linked binaries.
Data Source
AI summary
A computer-implemented method is presented for reporting monitoring data in a distributed computing system. The method includes: instrumenting service code with an agent, where the service code executes statelessly in an execution environment; capturing, by the agent, monitoring date during a first execution of the service code in the execution environment, where the monitoring data is indicative performance of the service code during the first execution; storing, by the agent, the monitoring data on an execution instance of the service code; and sending, by the agent, the monitoring data to a remote monitoring server during a second execution of the service code, where the second execution of the service code occurs after the first execution of the service code and the agent is located remotely across a network from the monitoring server.