IP Library Granted Patent US 9,298,432
Granted Patent B1
US 9,298,432 · App. 14/656,507 · Granted Mar 29, 2016

Systems and methods for performing hooking in a jitted environment

Inventor: Mikalaj Abramau (Minsk, BY)
Assignee: STEALTHbits Technologies, Inc.
G06F8/41
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,298,432
App. No.
14/656,507
Granted
Mar 29, 2016
Kind
B1
Abstract

A computing device configured for replacing a target method in intermediate language code is described. The computing device includes a processor. The computing device also includes memory in electronic communication with the processor. The computing device further includes instructions stored in the memory. The instructions are executable to import a hook method and hook type into a caller method module. The instructions are also executable to replace, in intermediate language code, any call to the target method in a caller method body with a call to the hook method. The instructions are further executable to compile the intermediate language code to assembly language code. The instructions are additionally executable to call the hook method in place of the target method.

Claims (41)

1. A computing device configured for replacing a target method in intermediate language code, comprising:

a processor;

a memory in electronic communication with the processor;

instructions stored in the memory, the instructions being executable to:

import a hook method and hook type into a caller module;

obtain a hook method token in the caller module, wherein a token is an integer number that describes a managed function, a managed property, or a managed instance;

replace, in intermediate language code, any call to the target method in a caller method body with a call to the hook method to generate modified intermediate language code, wherein replacing a call to the target method in a caller method body with a call to the hook method comprises substituting a target method token with the hook method token;

compile the modified intermediate language code to assembly language code, wherein compiling the modified intermediate language code comprises recompiling the modified intermediate language code by a just-in-time (JIT) compiler; and

call the hook method in place of the target method.

2. The computing device of claim 1 , wherein the hook method calls the target method.

3. The computing device of claim 1 , wherein the instructions are further executable to obtain a caller method type token, a target method type token and a hook method type token.

4. The computing device of claim 1 , wherein the intermediate language code originates from a Microsoft.NET managed environment.

5. The computing device of claim 1 , wherein the target method is a Microsoft Exchange method.

6. The computing device of claim 1 , wherein the instructions are further executable to:

obtain a caller type from a current assembly using reflection when the caller type is null;

obtain a target type from the current assembly using reflection when the target type is null;

obtain the caller method using reflection when the caller type is not null and the caller method is null; and

obtain the target method using reflection when the target type is not null and the target method is not null.

7. The computing device of claim 1 , wherein the instructions are further executable to:

determine whether a target method return type and a hook method return type are compatible;

determine whether the target method is static; and

determine whether target method parameters and hook method parameters are compatible.

8. A method for replacing a target method in intermediate language code, comprising:

importing a hook method and hook type into a caller module;

obtaining a hook method token in the caller module, wherein a token is an integer number that describes a managed function, a managed property, or a managed instance;

replacing, in intermediate language code, any call to the target method in a caller method body with a call to the hook method to generate modified intermediate language code, wherein replacing a call to the target method in a caller method body with a call to the hook method comprises substituting a target method token with the hook method token;

compiling the modified intermediate language code to assembly language code, wherein compiling the modified intermediate language code comprises recompiling the modified intermediate language code by a just-in-time (JIT) compiler; and

calling the hook method in place of the target method.

9. The method of claim 8 , wherein the hook method calls the target method.

10. The method of claim 8 , wherein the method further comprises obtaining a caller method type token, a target method type token and a hook method type token.

11. The method of claim 8 , wherein the intermediate language code originates from a Microsoft.NET managed environment.

12. The method of claim 8 , wherein the target method is a Microsoft Exchange method.

13. A non-transitory, tangible computer-readable medium for replacing a target method in intermediate language code, comprising executable instructions for:

importing a hook method and hook type into a caller module;

obtaining a hook method token in the caller module, wherein a token is an integer number that describes a managed function, a managed property, or a managed instance;

replacing, in intermediate language code, any call to the target method in a caller method body with a call to the hook method to generate modified intermediate language code, wherein replacing a call to the target method in a caller method body with a call to the hook method comprises substituting a target method token with the hook method token;

compiling the modified intermediate language code to assembly language code, wherein compiling the modified intermediate language code comprises recompiling the modified intermediate language code by a just-in-time (JIT) compiler; and

calling the hook method in place of the target method.

14. The computer-readable medium of claim 13 , wherein the hook method calls the target method.

15. The computer-readable medium of claim 13 , wherein the instructions are further executable for obtaining a caller method type token, a target method type token and a hook method type token.

16. The computer-readable medium of claim 13 , wherein the intermediate language code originates from a Microsoft.NET managed environment.

Assignments (5)
RELEASE OF SECURITY INTEREST Recorded Jul 7, 2022
From: TC LENDING, LLC, AS COLLATERAL AGENT
To: STEALTHBITS TECHNOLOGIES LLC (F/K/A STEALTHBITS TECHNOLOGIES II LLC)
Reel/Frame 060430/0798 →
SECURITY INTEREST Recorded Jun 9, 2022
From: NETWRIX CORPORATION; POLICYPAK SOFTWARE, LLC; STEALTHBITS TECHNOLOGIES LLC
To: GOLUB CAPITAL MARKETS LLC, AS COLLATERAL AGENT
Reel/Frame 060152/0855 →
MERGER AND CHANGE OF NAME Recorded Feb 25, 2021
From: STEALTHBITS TECHNOLOGIES, INC.; STEALTHBITS TECHNOLOGIES II LLC; STEALTHBITS TECHNOLOGIES II LLC
To: STEALTHBITS TECHNOLOGIES LLC
Reel/Frame 055416/0485 →
PATENT SECURITY AGREEMENT Recorded Dec 31, 2020
From: STEALTHBITS TECHNOLOGIES II LLC
To: TC LENDING, LLC, AS COLLATERAL AGENT
Reel/Frame 054884/0804 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 12, 2015
From: ABRAMAU, MIKALAJ
To: STEALTHBITS TECHNOLOGIES, INC.
Reel/Frame 035155/0697 →