Virtual Memory Duplication for Stealthy API Logging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current API-function call logging systems face challenges in compatibility across different operating systems and versions, often requiring modifications with OS updates and can be detected by malicious programs, limiting their effectiveness and reliability.
Innovation Solution
The method involves creating a duplicate virtual memory address space with different tagging mechanisms to manage the transfer of program execution between memory sectors, allowing for the logging of API function calls without altering the memory content, thereby enhancing compatibility and stealth.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code is introduced into system libraries to intercept API functions for logging, then logging capability is achieved, but system compatibility deteriorates with OS updates and detection by malicious programs increases
Solution Approach 1:
The patent creates a duplicate virtual address space that mirrors the original process address space. This copy contains duplicate code segments that can be executed instead of the original code, enabling logging functionality without modifying the original system libraries. The duplicate address space acts as a stealthy copy that achieves the same logging purpose without being detected by malicious programs or broken by OS updates.
Solution Approach 2:
The patent introduces a virtual memory translation layer that acts as an intermediary between the original code and the processor. By using page table mappings and address translation, the system can redirect execution to duplicate code in the virtual address space without directly modifying the original system libraries, thus maintaining compatibility while enabling logging.
2Object-affected harmful factors
If virtual memory duplication is used for stealthy execution, then detection resistance improves, but memory management complexity increases
Solution Approach 1:
The patent makes the virtual address space structure universal by creating duplicate code segments that can serve multiple purposes: both as legitimate program code and as stealthy logging infrastructure. The same virtual memory mechanisms that normally manage process code are reused to manage the duplicate logging code, eliminating the need for separate complex management systems.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are system and method for controlling execution of a program. An example method includes determining a memory sector for storing at least a portion of execution instructions of the computer program in virtual memory address space; determining, in the virtual memory address space, one or more pages that contain code instructions and data associated with the memory sector; creating a duplicate of the virtual memory address space comprising the memory sector and the one or more pages; tagging the memory sector and the one or more pages in both the virtual memory address space and its duplicate; receiving a notification to transfer execution of the computer program between different memory sectors while executing instructions stored in either the virtual memory address space or its duplicate; and transferring execution of the computer program to a memory location other than the one in which the notification was received.