Chained Hook Function Serving Multiple Versions Of Identically Named Dynamically Loaded Libraries

Abstract

A hooking system for hooking predetermined references to predetermined dynamically loaded library (DLL) functions includes a DLL version identifier provided by a hook entry code to an enhanced hook. The hook entry code is dynamically generated during runtime of an affected software application. The version identifier enables unambiguous communication of a single enhanced hook with functions of multiple versions of identically named DLLs loaded into the same isolated process memory area.

1 . A method for applying a hook to a reference referencing a predetermined function of a dynamically loaded library loaded into an isolated process memory area by an executing software application, said method comprising the steps of: 
 a. attempting to identify a relevant reference of said reference, said relevant reference referencing a relevant function of said function, said relevant function to be hooked by said hook;    b. in case of identifying during said step 1.a) said relevant reference: 
 i. dynamically generating distinct hook entry code for said relevant function;  
 ii. replacing said relevant reference with said dynamically generated hook entry code such that a consecutive invocation to said relevant function executes said dynamically generated hook entry code, whereby a version identifier is provided, said version identifier identifying a version of said dynamically loaded library; and  
   c. receiving and interpreting in an enhanced hook of said hook said version identifier such that said enhanced hook unambiguously identifies said dynamically loaded library having said version irrespective an eventual other identically named version of said dynamically loaded library loaded into said isolated process memory area.    
   
   
       2 . The method of  claim 1 , whereby in case of identifying said relevant reference during said step 1.a) a return address of said relevant function is pushed onto a stack of a code executing computing system within which said software application is said executing followed by said step 1.b.i) including the steps of: 
 a. pushing a target address of said relevant function onto said stack; followed by    b. pushing a hook address onto said stack; followed by    c. exchanging said return address with said target address on said stack; followed by    d. processing of said hook address from said stack and simultaneously passing said function return address from said stack as said version identifier to said enhanced hook; and    whereby said return address, said target address and said hook address are memory addresses within said isolated process memory area.    
   
   
       3 . The method of  claim 2 , wherein said return address is said pushed on a first stack location of said stack and said target address being said pushed on a second stack location of said stack, whereby said exchanging during said step 4.c) includes the steps of: 
 a. pushing a contents of a CPU register onto said stack;    b. loading said target address into said CPU register from said second stack location;    c. exchanging CPU register contents with said first stack location    d. storing CPU register contents to said second stack location; and    e. restoring original CPU register value from stack.    
   
   
       4 . The method of  claim 1 , whereby said hook is a single hook within said isolated process memory area.  
   
   
       5 . A hooking system hooking a function reference within an isolated memory area of a code executing computing system, said hooking system comprising: 
 a. a hook entry code generating sequence dynamically generating hook entry code including a dynamic link library version identifier;    b. an enhanced hook in receiving communication with said dynamically generated hook entry code, said hook interpreting said dynamically loaded library version identifier such that said hook unambiguously identifies a corresponding dynamically loaded library irrespective an eventual other identically named version of said dynamically loaded library and such that said hook establishes bidirectional communication with a function of said dynamic link library.    
   
   
       6 . The hooking system of  claim 5 , further comprising an exchanger routine exchanging a return address with a target address on a stack of said code executing computing system, said return address and said target address being memory addresses within said isolated process memory area of a function relevant for hooking.  
   
   
       7 . The hooking system of  claim 5 , being part of a virtual operating system.  
   
   
       8 . The hooking system of  claim 7 , wherein said function reference hooking system is compressed together with said virtual operating system in an executable file.  
   
   
       9 . The hooking system of  claim 5  being present solely in computer memory.  
   
   
       10 . A hooking system hooking a reference to a function of a dynamic link library within an isolated memory area of a code executing computing system, said hooking system comprising: 
 a. a dynamically generated hook entry code providing from a return address of said function a dynamic link library version identifier;    b. an enhanced hook in receiving communication with said dynamically generated hook entry code, said enhanced hook interpreting said dynamically loaded library version identifier such that said enhanced hook unambiguously identifies a corresponding one of said dynamically loaded library irrespective an eventual other identically named version of said dynamically loaded library and such that said enhanced hook establishes bidirectional communication with a function of said dynamically loaded library.    
   
   
       11 . The hooking system of  claim 10 , being part of a virtual operating system.  
   
   
       12 . The hooking system of  claim 10 , being present solely in computer memory.