Target process injection prior to execution of marker libraries
The disclosed embodiments provide a system that modifies execution of a target process in a computer system. During loading of a marker library by a target process, the system modifies import dependency data of the marker library to include an injection library as a dependency of a marker library. After the modified import dependency data is used to load the injection library into the target process by the operating system or loader, the system executes the injection library prior to execution of the marker library to revert the import dependency data to an original state and modify execution of the target process.
1. A method, comprising:
locking, by an operating system executing on a processor, virtual memory of a target process, wherein the virtual memory of the target process includes import dependency data of a marker library;
executing a kernel-mode injection driver at a passive level within the context of the target process when the marker library is loaded by the target process, wherein the executing the kernel-mode injection driver at the passive level within the context of the target process enables the kernel-mode injection driver to modify virtual memory tables within the target process;
setting, by the kernel-mode injection driver, a copy-on-write flag for a set of virtual memory tables of the target process which includes the import dependency data;
modifying, by the kernel-model injection driver, the import dependency data of the marker library to include an injection library as a dependency of the marker library in a first entry of the import dependency data and a null entry in a second entry of the import dependency data to terminate a list of entries in the import dependency data; and
after the modified import dependency data is used to load the injection library into the target process, executing the injection library prior to execution of the marker library to:
revert the modified import dependency data to an original state; and
modify execution of the target process.
2. The method of claim 1 , wherein the injection library is selected based on an environment of the target process, wherein the environment is at least one of:
a processor architecture; and
a runtime version.
3. The method of claim 1 , wherein modifying the import dependency data of the marker library to include the injection library as the dependency of the marker library comprises:
replacing an original dependency of the marker library in the import dependency data with the dependency on the injection library.
4. The method of claim 3 , wherein reverting the import dependency data to the original state comprises:
writing the original dependency back into the import dependency data prior to execution of the marker library.
5. The method of claim 1 , wherein modifying the import dependency data of the marker library to include the injection library as the dependency of the marker library comprises:
modifying an import table in the import dependency data of the marker library to include the injection library.
6. The method of claim 1 , wherein the execution of the target process is modified using at least one of:
the injection library; and
an additional library loaded by the injection library.
7. The method of claim 1 , wherein modifying execution of the target process comprises at least one of:
profiling the target process;
modifying an environment of the target process; and
modifying a behavior of the target process.
8. The method of claim 1 , wherein the target process executes within a Windows operating system on the computer system.
9. An apparatus, comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
lock virtual memory of a target process, wherein the virtual memory of the target process includes import dependency data of a marker library;
execute a kernel-mode injection driver at a passive level within the context of the target process when the marker library is loaded by the target process, wherein the executing the kernel-mode injection driver at the passive level within the context of the target process enables the kernel-mode injection driver to modify virtual memory tables of the target process;
set a copy-on-write flag for a set of virtual memory tables of the target process which includes the import dependency data;
modify the import dependency data of the marker library to include an injection library as a dependency of the marker library in a first entry of the import dependency data and a null entry in a second entry of the import dependency data to terminate a list of entries in the import dependency data; and
after the modified import dependency data is used to load the injection library into the target process, executing the injection library prior to execution of the marker library to:
revert the modified import dependency data to an original state; and
modify execution of the target process.
10. The apparatus of claim 9 , wherein the injection library is selected based on an environment of the target process, wherein the environment is at least one of:
a processor architecture; and
a runtime version.
11. The apparatus of claim 9 , wherein modifying the import dependency data of the marker library to include the injection library as the dependency of the marker library comprises at least one of:
replacing an original dependency of the marker library in the import dependency data with the dependency on the injection library; and
modifying an import table in the import dependency data of the marker library to include the injection library.
12. The apparatus of claim 9 , wherein the execution of the target process is modified using at least one of:
the injection library; and
an additional library loaded by the injection library.
13. The apparatus of claim 9 , wherein modifying execution of the target process comprises at least one of:
profiling the target process;
modifying an environment of the target process; and
modifying a behavior of the target process.
14. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:
locking, by an operating system executing on a processor, virtual memory of a target process, wherein the virtual memory of the target process includes import dependency data of a marker library;
executing a kernel-mode injection driver at a passive level within the context of the target process when the marker library is loaded by the target process, wherein the executing the kernel-mode injection driver at the passive level within the context of the target process enables the kernel-mode injection driver to modify virtual memory tables within the target process;
setting, by the kernel-mode injection driver, a copy-on-write flag for a set of virtual memory tables of the target process which includes the import dependency data;
modifying the import dependency data of the marker library to include an injection library as a dependency of the marker library in a first entry of the import dependency data and a null entry in a second entry of the import dependency data to terminate a list of entries in the import dependency data; and
after the modified import dependency data is used to load the injection library into the target process, executing the injection library prior to execution of the marker library to:
revert the modified import dependency data to an original state; and
modify execution of the target process.
15. The non-transitory computer-readable medium of claim 14 , wherein modifying the import dependency data of the marker library to include the injection library as the dependency of the marker library comprises at least one of:
replacing an original dependency of the marker library in the import dependency data with the dependency on the injection library; and
modifying an import table in the import dependency data of the marker library to include the injection library.