RPC call interception
A service proxy is described herein. The service proxy is configured to act as an intermediary between a client and a service. The service proxy may observe communications, modify communications, log communications, or the like, particularly so as to enhance the security and reliability of the host device. In some implementations, the service proxy may cooperate with an operating system to take over a named port object. In some implementations, the service proxy may receive messages as an intermediary between the client and the server. In some implementations, the service proxy may attach to a shared memory to intercept communications. In some implementations, the service proxy may be injected into a client process to appear to be the client itself.
1. One or more tangible computer-readable media storing computer-executable instructions configured to implement an observation service on a computer device, the observation service performing operations comprising:
requesting, from a kernel-level resource, to rename a name-addressable port from an original name to a modified name;
adding an entry to an object manager using the original name, the entry being associated with the observation service;
receiving, from a caller and at the observation service, a communication addressed to the original name, the communication including a reference to a shared memory region;
determining, from the communication, an availability of data written to the shared memory region by the caller;
examining the data in the shared memory region;
after examining the data in the shared memory region, modifying a process identifier (PID) or a thread identifier (TID) of the communication; and
redirecting the communication to the name-addressable port addressed by the modified name.
2. The one or more tangible computer-readable media of claim 1 , further comprising analyzing the communication.
3. The one or more tangible computer-readable media of claim 2 , further comprising characterizing the communication as safe, unsafe, or unknown, based at least in part on the analyzing of the communication.
4. The one or more tangible computer-readable media of claim 2 , further comprising determining a format of the communication based at least in part on an Interface Description Language (IDL) associated with a service accessible to the caller via the name-addressable port, wherein the analyzing of the communication is based at least in part on the format.
5. The one or more tangible computer-readable media of claim 1 , wherein the observation service is configured to have less-than kernel-level permissions.
6. The one or more tangible computer-readable media of claim 1 , further comprising:
receiving, from the name-addressable port, an indication of a communication session including a reference to a server port;
creating a session observation port;
modifying the indication of the communication session, including referencing the session observation port instead of the server port; and
providing the indication of the communication session to the caller.
7. The one or more tangible computer-readable media of claim 6 , wherein
receiving the communication comprises receiving the communication at the session observation port,
the method further comprising requesting, from the kernel-level resource, to attach to the shared memory region; and
wherein redirecting the communication comprises sending, to the server port, a proxied message based, at least in part, on the communication that was received.
8. The one or more tangible computer-readable media of claim 7 , further comprising analyzing a portion of the shared memory region.
9. The one or more tangible computer-readable media of claim 1 , wherein the modifying of the PID or the TID of the communication generates a modified PID or TID that indicates the observation service as the source of the communication.
10. A computer-implemented method for observing a service comprising:
requesting to rename a name-addressable port of the service from an original name to a modified name;
adding an entry to an object manager using the original name, the entry being associated with an observation service;
receiving, from a caller and at the observation service, a communication addressed to the original name, the communication including a reference to a shared memory region;
determining, from the communication, an availability of data written to the shared memory region by the caller;
examining, by the observation service, the data in the shared memory region;
after examining the data in the shared memory region, modifying a process identifier (PID) or a thread identifier (TID) of the communication for transparent redirection; and
redirecting the communication to the name-addressable port addressed by the modified name.
11. The method of claim 10 , further comprising analyzing the communication.
12. The method of claim 10 , wherein the observation service is configured to have less-than kernel-level permissions.
13. The method of claim 10 , further comprising:
receiving, from the name-addressable port, an indication of a communication session including a reference to a server port;
creating a session observation port;
modifying the indication of the communication session, including referencing the session observation port instead of the server port; and
providing the indication of the communication session to the caller.
14. The method of claim 13 , wherein:
receiving the communication comprises receiving the communication at the session observation port,
the method further comprising requesting to attach to the shared memory region; and
wherein redirecting the communication comprises sending, to the server port, a proxied message based, at least in part, on the communication that was received.
15. A system comprising:
a processor; and
memory storing computer-executable instructions that, when executed by the processor, implement an observation service to:
request to rename a name-addressable port of a service from an original name to a modified name;
receive, from a caller, a communication addressed to the original name, the communication including a reference to a shared memory region;
determine, from the communication, an availability of data written to the shared memory region by the caller;
examine the data in the shared memory region;
after examining the data in the shared memory region, modify a process identifier (PID) or a thread identifier (TID) of the communication for transparent redirection; and
redirect the communication to the name-addressable port addressed by the modified name.
16. The system of claim 15 , wherein the observation service is further configured to analyze the communication.
17. The system of claim 15 , wherein the observation service is configured to have less-than kernel-level permissions.
18. The system of claim 15 , wherein the observation service is further configured to:
receive, from the name-addressable port, an indication of a communication session including a reference to a server port;
create a session observation port;
modify the indication of the communication session, including referencing the session observation port instead of the server port; and
provide the indication of the communication session to the caller.
19. The system of claim 18 , wherein:
receiving the communication comprises receiving the communication at the session observation port,
the computer-executable instructions, when executed by the processor, further implement the observation service to request to attach to the shared memory region; and
wherein redirecting the communication comprises sending, to the server port, a proxied message based, at least in part, on the communication that was received.