System, method, and computer program product for compatibility among hooking applications
View Patent ↗A system, method and computer program product for permitting use of multiple hooking applications to hook an interface. Included are a first hooking application and a second hooking application. Further provided is computer code including a vector and a stub dynamic link library (DLL) for permitting the first hooking application and the second hooking application to both hook an interface.
1. A system, comprising:
a processor;
a first hooking application;
a second hooking application; and
computer code including a vector and a stub dynamic link library (DLL) for permitting the first hooking application and the second hooking application to both hook an interface;
wherein the system is operable such that at least one vector is created for each call hooked by at least one of the first hooking application and the second hooking application.
2. The system of claim 1 , wherein the interface includes an application program interface (API).
3. The system of claim 2 , wherein the API includes an operating system (OS) API.
4. The system of claim 1 , wherein the computer code permits the first hooking application and the second hooking application to both hook interface calls.
5. The system of claim 1 , wherein at least one of the first hooking application and the second hooking application includes a security application.
6. The system of claim 5 , wherein at least one of the first hooking application and the second hooking application includes an intrusion detection application.
7. The system of claim 6 , wherein the vector includes executable computer code.
8. The system of claim 7 , wherein the vector is executed upon the interface being invoked.
9. The system of claim 8 , wherein data associated with the invoked interface is identified utilizing the vector.
10. The system of claim 9 , wherein the data is utilized by a handler.
11. A system, comprising:
a processor;
a first hooking application;
a second hooking application; and
computer code including a vector and a stub dynamic link library (DLL) for permitting the first hooking application and the second hooking application to both hook an interface;
wherein the vector includes executable computer code;
wherein the vector is executed upon the interface being invoked;
wherein data associated with the invoked interface is identified utilizing the vector;
wherein the data associated with the invoked interface is identified by: identifying a location of a central processing unit (CPU) instruction pointer.
12. The system of claim 11 , wherein the data associated with the invoked interface is further identified by: identifying a start of the vector.
13. The system of claim 12 , wherein the start of the vector is identified utilizing arithmetic.
14. The system of claim 12 , wherein the data associated with the invoked interface is further identified by: retrieving the data utilizing the identified start of the vector and the CPU instruction pointer.
15. A system, comprising:
a processor;
a first hooking application;
a second hooking application; and
computer code including a vector and a stub dynamic link library (DLL) for permitting the first hooking application and the second hooking application to both hook an interface;
wherein the stub DLL is reloaded by changing handler addresses in a list of vectors to point to a temporary handler.
16. The system of claim 15 , wherein the stub DLL is further reloaded by loading a new stub DLL.
17. The system of claim 16 , wherein the stub DLL is further reloaded by changing the handler addresses in the list of vectors to point to a new handler associated with the new stub DLL.
18. A method, comprising:
simultaneously hooking an interface utilizing, a first hooking application and a second hooking application;
storing computer code in a memory, the computer code including a vector and a stub dynamic link library (DLL) permits the first hooking application and the second hooking application to both hook an interface;
creating at least one vector for each call hooked by at least one of the first hooking application and the second hooking application.
19. A memory having stored thereon a computer program product comprising:
a first hooking application;
a second hooking application; and
a vector and a stub dynamic link library (DLL) for permitting the first hooking application and the second hooking application to both hook an interface;
wherein the computer program product is operable such that at least one vector is created for each call hooked by at least one of the first hooking application and the second hooking application.