Advanced injection rule engine
Systems and techniques are described for controlling injection of a library into a process. Specifically, some embodiments provide an Advanced Injection Rule Engine (AIRE), which uses a set of rules to selectively inject a library, e.g., a dynamic-link library (DLL), into a process. Some embodiments implement a Domain Specific Language (DSL), called AIRE Script, to define the injection rules that are used by the AIRE at runtime.
1. A method for controlling injection of a library into a process executing on a computer, the method comprising:
creating a set of rules to control injection of the library, wherein each rule is specified in a domain specific language having a syntax comprising an action statement and a condition statement, wherein the action statement includes a first keyword associated with activation or a second keyword associated with deactivation, and wherein the condition statement specifies a logical function that is defined over one or more properties of the process; and
applying, by an injection rule engine (IRE) executing on the computer, the set of rules to the process executing on the computer, wherein said applying comprises:
selecting, by the IRE, a rule from the set of rules,
evaluating, by the IRE, a condition specified in the selected rule, wherein the condition is defined over a set of properties associated with the process, wherein the set of properties includes an executable image name of the process, and
in response to the condition evaluating as true, performing, by the IRE, an injection action specified in the rule on the process.
2. The method of claim 1 , wherein rules are selected from the set of rules in a predetermined order.
3. The method of claim 2 , wherein in response to the condition evaluating as false, selecting a next rule from the set of rules to apply to the process.
4. The method of claim 1 , wherein performing the injection action comprises injecting the library into the process.
5. The method of claim 1 , wherein performing the injection action comprises (1) not injecting the library into the process, and (2) not applying any additional rules in the set of rules to the process.
6. The method of claim 1 , wherein the set of properties includes a filesystem path of the executable image of the process.
7. The method of claim 1 , wherein the set of properties includes a version of the executable image of the process.
8. The method of claim 1 , wherein the set of properties includes an indicator that specifies whether a particular library is loaded within the process.
9. The method of claim 1 , wherein the set of properties includes command line arguments that were provided when the process was executed.
10. The method of claim 1 , wherein the set of properties includes an environment variable of the process.
11. The method of claim 1 , wherein the set of properties includes a processor architecture of the executable image of the process.
12. The method of claim 1 , wherein the set of properties includes a user identifier associated with the process.
13. The method of claim 1 , wherein the library is an instrumentation library which, when injected into the process, provides visibility into processor and memory usage of the process.
14. A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to:
create a set of rules to control injection of the library, wherein each rule is specified in a domain specific language having a syntax comprising an action statement and a condition statement, wherein the action statement includes a first keyword associated with activation or a second keyword associated with deactivation, and wherein the condition statement specifies a logical function that is defined over one or more properties of the process; and
apply, by an injection rule engine (IRE) executing on the computer, the set of rules to a process executing on the computer, wherein said applying comprises:
selecting, by the IRE, a rule from the set of rules,
evaluating, by the IRE, a condition specified in the selected rule, wherein the condition is defined over a set of properties associated with the process, wherein the set of properties includes an executable image name of the process, and
in response to the condition evaluating as true, performing, by the IRE, an injection action specified in the rule on the process.
15. The non-transitory computer-readable storage medium of claim 14 , wherein rules are selected from the set of rules in a predetermined order.
16. The non-transitory computer-readable storage medium of claim 15 , wherein in response to the condition evaluating as false, selecting a next rule from the set of rules to apply to the process.
17. The non-transitory computer-readable storage medium of claim 14 , wherein performing the injection action comprises injecting the library into the process.
18. The non-transitory computer-readable storage medium of claim 14 , wherein performing the injection action comprises (1) not injecting the library into the process, and (2) not applying any additional rules in the set of rules to the process.
19. An apparatus, comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the processor to:
create a set of rules to control injection of the library, wherein each rule is specified in a domain specific language having a syntax comprising an action statement and a condition statement, wherein the action statement includes a first keyword associated with activation or a second keyword associated with deactivation, and wherein the condition statement specifies a logical function that is defined over one or more properties of the process; and
apply, by an injection rule engine (IRE) executing on the processor, the set of rules to a process executing on the processor, wherein said applying comprises:
selecting, by the IRE, a rule from the set of rules,
evaluating, by the IRE, a condition specified in the selected rule, wherein the condition is defined over a set of properties associated with the process, wherein the set of properties includes an executable image name of the process, and
in response to the condition evaluating as true, performing, by the IRE, an injection action specified in the rule on the process.