Runtime Code Hooking via Placeholder Instructions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for hooking executable code require direct changes to source code and recompilation, which are time-consuming and costly, and are not suitable for modifications at runtime or when source code is not available, and TAT overwriting is limited to inter-module calls and can be defeated by static linking.
Innovation Solution
The use of placeholder instructions within a compiled module as an entry point for runtime code hooking, where a hook function is developed to modify a target function by overwriting the placeholder instruction with instructions that cause execution of the hook function when the target function is called, allowing for code modification without recompilation or rebooting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional source code modification and recompilation is used to hook code, then code functionality can be modified, but it requires time-consuming recompilation and is not suitable for runtime modifications
Solution Approach 1:
The patent applies preliminary action by inserting placeholder instructions into the target code during the compilation phase, before runtime. These placeholders are pre-positioned at specific locations where code hooking is desired, allowing the hooked code to be injected at runtime without requiring recompilation. The placeholder serves as a pre-prepared entry point that enables future code modification without affecting the original compilation process.
Solution Approach 2:
The patent uses placeholder instructions as an intermediary mechanism between the original code and the hooked code. The placeholder acts as a mediator that can be replaced or jumped to at runtime, enabling the insertion of additional functionality without directly modifying the original source code or requiring recompilation. This intermediary approach allows seamless integration of hooked code while maintaining the integrity of the original compiled binary.
2Adaptability or versatility
If TAT (Import Address Table) overwriting is used to hook code, then inter-module code can be hooked, but it cannot hook direct calls and is defeated by static linking
Solution Approach 1:
The patent extracts the limitation of TAT overwriting by directly modifying the target code's instruction stream at runtime rather than relying on the import address table. By using placeholder instructions embedded within the target module itself, the solution bypasses the TAT mechanism entirely and directly intercepts function calls through code injection at the placeholder location, thereby hooking both direct and indirect calls effectively.
Solution Approach 2:
The patent transitions from the TAT dimension (import address table manipulation) to a code injection dimension by placing hooks directly within the target module's code stream at placeholder instructions. This dimensional shift allows the hook to intercept calls at the actual execution point rather than at the linking stage, making it effective against both static and dynamic calls regardless of linking methodology.
3Ease of operation
If placeholder instructions are used for runtime code hooking, then code can be modified without recompilation, but the target code must be compiled with placeholder support
Solution Approach 1:
The compilation process performs preliminary action by automatically inserting placeholder instructions at designated locations within the target code. This preliminary insertion is done as part of the standard compilation workflow, and once compiled, the binary contains these placeholders that enable runtime hooking without requiring any special compilation flags or complex build processes. The placeholder insertion is transparent to the developer and integrated into the normal compilation flow.
Data Source
AI summary
Runtime code hooking techniques are described in which a place holder instruction within a compiled module is used as an entry point to enable code hooking. A hook function to modify a target function is developed. At runtime, the target function to be modified is located. A place holder instruction within the target function is overwritten with instructions to cause execution of the hook function when the target function is called.