Hook re-entry prevention device and recording medium, in which program for executing method thereof in computer is recorded thereon

1. A device for preventing hook re-entry defined as recursive execution of a hook function executed by dynamic API hooking, the device comprising:

at least one processor operable to read and operate according to instructions within a computer program; and

at least one memory operable to store at least portions of said computer program for access by said processor,

wherein said program includes algorithms to cause said processor to implement:

a state information management module configured to set a value of a state information flag corresponding to the hook function to a first value at a point of time when a system layer calls the hook function in response to a call for an original function by an application program; and

a re-entry prevention module configured to check the value of the state information flag when the hook function is called, and to forward a resulting value which is an output value of a first sub-function which calls the hook function to the system layer so as to cause the system layer to induce execution of one or more remaining sub-functions by returning the resulting value to a second sub-function out of the remaining sub-functions right behind the first sub-function in an execution order when the value of the state information flag is the first value,

wherein a hook routine is composed of the first sub-function and the remaining sub-functions and performed on a hook layer,

wherein the state information management module sets the value of the state information flag to a second value, when or after the hook routine is terminated.

2. The device of claim 1 , wherein the value of the state information flag is recorded in a global data variable, thread local storage, a static data variable or a data object that is identifiable for each thread in response to the hook function.

3. The device of claim 2 , further comprising a thread generation detection module configured to set a value of a state information of a thread to the first value at a point of time when the thread is generated during the execution of the hook routine,

wherein the re-entry prevention module determines that the calling of the hook function has been performed during the execution of the hook routine when the hook function is called by the thread of which value of the state information is the first value by the thread generation detection module.

4. The device of claim 1 , further comprising a thread generation detection module configured to set a value of a state information of a thread to the first value at a point of time when the thread is generated during the execution of the hook routine,

wherein the re-entry prevention module determines that the calling of the hook function has been performed during the execution of the hook routine when the hook function is called by the thread of which value of the state information is the first value by the thread generation detection module.

5. A non-transitory computer-readable recording medium recording a program for executing instructions performing a method of preventing hook re-entry defined as recursive execution of a hook function executed by dynamic API hooking, the method comprising:

(a) setting a value of a state information flag corresponding to the hook function to a first value at a point of time when a system layer calls the hook function in reponse to a call for an original function by an application program;

(b) checking the value of the state information flag set in function information corresponding to the hook function when the hook function is called;

(c) forwarding a resulting value which is an output value of a first sub-function which calls the hook function to the system layer so as to cause the system layer to induce execution of one or more remaining sub-functions by returning the resulting value to a second sub-function out of the remaining sub-functions right behind the first sub-function in an execution order when the value of the state information flag is the first value; and

(d) setting the value of the state information flag to a second value when or after the hook routine is terminated,

Wherein a hook routine is composed of the first sub-function and the remaining sub-functions and performed on a hook layer.

6. The non-transitory computer-readable recording medium of claim 5 , wherein the value of the state information flag is recorded in a global data variable, thread local storage, a static data variable or a data object that is identifiable for each thread in response to the hook function.

7. The non-transitory computer-readable recording medium of claim 6 , wherein the method further comprises setting a value of a state information of the thread to the first value during the execution of the hook routine,

wherein step (b) comprises determining that the calling of the hook function has been performed during the execution of the hook routine when the hook function is called by the thread of which value of the state information is the first value.

8. The non-transitory computer-readable recording medium of claim 5 , wherein the method further comprises setting a value of a state information of the thread to the first value during the execution of the hook routine,

wherein step (b) comprises determining that the calling of the hook function has been performed during the execution of the hook routine when the hook function is called by the thread of which value of the state information is the first value.