Native code profiler framework
View Patent ↗Embodiments provide systems, methods, and computer program products for dynamically hooking multiple levels of application code. A server receives identifying information that identifies a target function of a target application to hook. The server pauses a target process of the target application. The server locates the target function within the target application code based on the received identifying information. The server then hooks the located function outside of the target application, thereby creating hooked code during application runtime.
1. A method for hooking machine code, comprising:
receiving, at a server, from an adapter module identifying information for a target function of a target application to hook;
pausing, by the server, the target application;
locating, by the server, the target function in the target application based on the identifying information;
hooking, by the server, the target function outside the target application to create hooked code, wherein said hooking comprises:
determining whether the target application was designed for a first architecture type or a second architecture type,
determining, in response to the target application being designed for the second architecture type, whether a distance between a location of the target function and a location of the hooked code is greater than a pre-set address offset,
overlaying an instruction set having a first size to jump to a first new code location in response to the target application being designed for the first architecture type or in response to determining that the distance is less than the pre-set offset, and
overlaying an instruction set having a second size to jump to a second new code location in response to determining that the distance is greater than the pre-set offset, wherein the second size is larger than the first size; and
maintaining, by the server, a tracking table for tracking hook points, wherein the hook points correspond to locations where one or more target functions are hooked.
2. The method of claim 1 , wherein the hooking comprises:
allocating virtual memory in the target application for the hooked code;
injecting an adapter host library into the target application; and
modifying application code of the target function with a hook call, the method further comprising:
unpausing the target application to continue operation.
3. The method of claim 1 , wherein the identifying information comprises a function name of the target function, the locating the target function comprising:
locating an entry in an export name table corresponding to the function name;
indexing into a location of an export ordinal table based on an index value corresponding to the located entry in the export name table;
indexing into an export address table based on the indexed location of the export ordinal table to obtain a relative virtual address of the target function; and
determining an address of the target function by combining the relative virtual address to a base address of a library in the target application.
4. The method of claim 1 , wherein the identifying information comprises a function ordinal of the target function, the locating the target function comprising:
identifying an export directory base address based on structure information for a header of the target application;
subtracting the export directory base address from the function ordinal to obtain an index value;
indexing into an export address table, using the index value, to obtain a relative virtual address of the target function; and
determining an address of the target function by combining the relative virtual address to a base address of a library in the target application.
5. The method of claim 1 , wherein the target function comprises a forwarded function, the locating further comprising:
locating the forwarded function identified as the target function;
following forwarding information in the forwarded function to an end of a forwarding chain, the end comprising an originating alias function; and
using an address of the originating alias function as an address of the target function.
6. The method of claim 1 , further comprising:
allocating virtual memory for the hooked code;
receiving a unique identifier from the adapter module in response to hooking the code;
identifying the hooked code by the unique identifier in the tracking table; and
removing the unique identifier from the tracking table in response to de-hooking of the target function.
7. The method of claim 1 , further comprising dynamically hooking and de-hooking the identified function during execution of the target application module.
8. A system for hooking machine code, comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the system to perform a method comprising:
receiving identifying information for a target function of a target application to hook;
pausing the target application;
locating the target function in the target application based on the identifying information;
hooking, by the server, the target function outside the target application to create hooked code, wherein said hooking comprises:
determining whether the target application was designed for a first architecture type or a second architecture type,
determining, in response to the target application being designed for the second architecture type, whether a distance between a location of the target function and a location of the hooked code is greater than a pre-set address offset,
overlaying an instruction set having a first size to jump to a first new code location in response to the target application being designed for the first architecture type or in response to determining that the distance is less than the pre-set offset, and
overlaying an instruction set having a second size to jump to a second new code location in response to determining that the distance is greater than the pre-set offset, wherein the second size is larger than the first size; and
maintaining, by the server, a tracking table for tracking hook points, wherein the hook points correspond to locations where one or more target functions are hooked.
9. The system of claim 8 , wherein the method further comprises:
injecting the adapter host module into the target application module;
modifying application code of the target function with a hook call; and
unpausing the execution the target application module to continue operation.
10. The system of claim 8 , wherein identifying information comprises a function name of the target function, and wherein the method further comprises:
locating an entry in an export name table corresponding to the function name;
indexing into a location of an export ordinal table based on an index value corresponding to the located entry in the export name table;
indexing into an export address table based on the indexed location of the export ordinal table to obtain a relative virtual address of the target function; and
determining an address of the target function by combining the relative virtual address to a base address of a library in the target application module.
11. The system of claim 8 , wherein the identifying information comprises a function ordinal of the target function, and the method further comprises:
identifying an export directory base address based on structure information for a header of the target application module;
subtracting the export directory base address from the function ordinal to obtain an index value;
indexing into an export address table, using the index value, to obtain a relative virtual address of the target function; and
determining an address of the target function by combining the relative virtual address to a base address of a library in the target application module.
12. The system of claim 8 , wherein the target function comprises a forwarded function, and the method further comprises:
locating the forwarded function identified as the target function;
following forwarding information in the forwarded function to an end of a forwarding chain, the end comprising an originating alias function; and
using an address of the originating alias function as an address of the target function.
13. The system of claim 8 , wherein the method further comprises dynamically hooking and de-hooking the identified function during execution of the target application module.
14. A non-transitory computer-readable storage medium having control logic recorded thereon that, when executed by a processor, causes the processor to perform a method for hooking machine code, the method comprising:
receiving identifying information for a target function of a target application to hook from an adapter module;
pausing the target application;
locating the target function in the target application based on the identifying information;
hooking, by the server, the target function outside the target application to create hooked code, wherein said hooking comprises:
determining whether the target application was designed for a first architecture type or a second architecture type,
determining, in response to the target application being designed for the second architecture type, whether a distance between a location of the target function and a location of the hooked code is greater than a pre-set address offset,
overlaying an instruction set having a first size to jump to a first new code location in response to the target application being designed for the first architecture type or in response to determining that the distance is less than the pre-set offset, and
overlaying an instruction set having a second size to jump to a second new code location in response to determining that the distance is greater than the pre-set offset, wherein the second size is larger than the first size; and
maintaining, by the server, a tracking table for tracking hook points, wherein the hook points correspond to locations where one or more target functions are hooked.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the hooking comprises:
injecting an adapter host library into the target application; and
modifying application code with a hook call, the method further comprising:
unpausing the target application to continue operation.
16. The non-transitory computer-readable storage medium of claim 14 , wherein the identifying information comprises a function name of the target function, the locating the target function comprising:
locating an entry in an export name table corresponding to the function name;
indexing into a location of an export ordinal table based on an index value corresponding to the located entry in the export name table;
indexing into an export address table based on the indexed location of the export ordinal table to obtain a relative virtual address of the target function; and
determining an address of the target function by combining the relative virtual address to a base address of a library in the target application.
17. The non-transitory computer-readable storage medium of claim 14 , wherein the identifying information comprises a function ordinal of the target function, the locating the target function comprising:
identifying an export directory base address based on structure information for a header of the target application;
subtracting the export directory base address from the function ordinal to obtain an index value;
indexing into an export address table, using the index value, to obtain a relative virtual address of the target function; and
determining an address of the target function by combining the relative virtual address to a base address of a library in the target application.
18. The non-transitory computer-readable storage medium of claim 14 , wherein the target function comprises a forwarded function, the locating further comprising:
locating the forwarded function identified as the target function;
following forwarding information in the forwarded function to an end of a forwarding chain, the end comprising an originating alias function; and
using an address of the originating alias function as an address of the target function.
19. The non-transitory computer-readable storage medium of claim 14 , wherein the method further comprises dynamically hooking and de-hooking the identified function during execution of the target application module.