Virtual Memory Duplication for Stealthy API Logging

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current API-function call logging systems face challenges in compatibility across different operating systems and versions, often requiring modifications with OS updates and can be detected by malicious programs, limiting their effectiveness and reliability.

Innovation Solution

The method involves creating a duplicate virtual memory address space with different tagging mechanisms to manage the transfer of program execution between memory sectors, allowing for the logging of API function calls without altering the memory content, thereby enhancing compatibility and stealth.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If code is introduced into system libraries to intercept API functions for logging, then logging capability is achieved, but system compatibility deteriorates with OS updates and detection by malicious programs increases

Engineering Contradiction:
Improvelogging system reliabilityVSAvoidoperating system compatibility
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent creates a duplicate virtual address space that mirrors the original process address space. This copy contains duplicate code segments that can be executed instead of the original code, enabling logging functionality without modifying the original system libraries. The duplicate address space acts as a stealthy copy that achieves the same logging purpose without being detected by malicious programs or broken by OS updates.

Inventive Principle:
Principle #26Copying

Solution Approach 2:

The patent introduces a virtual memory translation layer that acts as an intermediary between the original code and the processor. By using page table mappings and address translation, the system can redirect execution to duplicate code in the virtual address space without directly modifying the original system libraries, thus maintaining compatibility while enabling logging.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If virtual memory duplication is used for stealthy execution, then detection resistance improves, but memory management complexity increases

Engineering Contradiction:
Improvedetection by malicious programsVSAvoidmemory management complexity
Core Design Contradiction:
Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The patent makes the virtual address space structure universal by creating duplicate code segments that can serve multiple purposes: both as legitimate program code and as stealthy logging infrastructure. The same virtual memory mechanisms that normally manage process code are reused to manage the duplicate logging code, eliminating the need for separate complex management systems.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP3252610B1System and method of transfer of control between memory locations
Publication Date: 2021.06.16 AO KASPERSKY LAB
  • EP3252610B1 patent drawingFigure 1
  • EP3252610B1 patent drawingFigure 2
  • EP3252610B1 patent drawingFigure 3

AI summary

Disclosed are system and method for controlling execution of a program. An example method includes determining a memory sector for storing at least a portion of execution instructions of the computer program in virtual memory address space; determining, in the virtual memory address space, one or more pages that contain code instructions and data associated with the memory sector; creating a duplicate of the virtual memory address space comprising the memory sector and the one or more pages; tagging the memory sector and the one or more pages in both the virtual memory address space and its duplicate; receiving a notification to transfer execution of the computer program between different memory sectors while executing instructions stored in either the virtual memory address space or its duplicate; and transferring execution of the computer program to a memory location other than the one in which the notification was received.