IP Library Granted Patent US 12,340,188
Granted Patent B1
US 12,340,188 · App. 18/059,342 · Granted Jun 24, 2025

Zero modification export hooking

Inventor: John J. Delio, Jr. (Manchester, NH)
Assignee: RIVERBED TECHNOLOGY LLC
G06F8/36
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,340,188
App. No.
18/059,342
Granted
Jun 24, 2025
Kind
B1
Abstract

A first request may be received from a loader to create a first file handle corresponding to a first library, where the first request may include a first identifier corresponding to the first library, and where the loader may be part of an operating system of a computer system. It may be determined that the first library is to be proxied by a second library. The first identifier in the first request may be replaced with a second identifier corresponding to the second library. The first file handle may be created based on the first request. The first file handle may be provided to the loader. An export section of a first image corresponding to the first file handle may be customized when the first image is mapped into a memory.

Claims (54)

1. A method, comprising:

receiving a first request from a loader to create a first file handle corresponding to a first library, wherein the first request includes a first identifier corresponding to the first library, and wherein the loader is part of an operating system of a computer system;

determining whether the first library is to be proxied by a second library;

responsive to determining that the first library is to be proxied by the second library, replacing the first identifier in the first request with a second identifier corresponding to the second library;

creating the first file handle based on the first request; and

providing the first file handle to the loader, wherein the providing the first file handle to the loader comprises replacing the second identifier with the first identifier in a first response corresponding to the first request.

2. The method of claim 1 , further comprising:

detecting that a first image corresponding to the first file handle is mapped into a memory of the computer system; and

customizing an export section of the first image based on a first set of export symbols in the first library and a second set of export symbols in the second library.

3. The method of claim 2 , wherein the customizing the export section of the first image comprises:

determining an export symbol that is in the first set of export symbols but is not in the second set of export symbols; and

adding a forwarding reference into the export section of the first image, wherein the forwarding reference corresponds to the export symbol in the second library.

4. The method of claim 3 , wherein the determining whether the first library is to be proxied by the second library comprises caching the first set of export symbols in the first library.

5. The method of claim 1 , wherein the determining whether the first library is to be proxied by the second library comprises determining if the first identifier is in a set of identifiers corresponding to libraries that are desired to be proxied.

6. The method of claim 1 , further comprising:

receiving a second request from the loader to create a second file handle, wherein the second request includes a third identifier;

determining whether the third identifier in the second request is desired to be replaced with the first identifier;

responsive to determining that the third identifier in the second request is desired to be replaced with the first identifier, replacing the third identifier in the second request with the first identifier;

creating the second file handle based on the second request; and

providing the second file handle to the loader, wherein the providing the first file handle to the loader comprises replacing the second identifier with the first identifier in a first response corresponding to the first request.

7. The method of claim 6 , wherein the first identifier is a first file system path corresponding to the first library, wherein the second identifier is a second file system path corresponding to the second library, and wherein the third identifier is a third file system path.

8. The method of claim 7 , wherein the third file system path is an invalid path.

9. The method of claim 6 , wherein the determining whether the third identifier in the second request is desired to be replaced with the first identifier comprises determining if the third identifier is in a set of identifiers that are desired to be replaced.

10. The method of claim 6 , wherein a second response corresponding to the second request includes the second file handle and the third identifier.

11. A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to:

receive a first request from a loader to create a first file handle corresponding to a first library, wherein the first request includes a first identifier corresponding to the first library;

determine that the first library is to be proxied by a second library in response to determining that the first identifier is in a set of identifiers corresponding to libraries that are desired to be proxied;

replace the first identifier in the first request with a second identifier corresponding to the second library;

create the first file handle based on the first request; and

provide the first file handle to the loader, wherein the providing the first file handle to the loader comprises replacing the second identifier with the first identifier in a first response corresponding to the first request.

12. The non-transitory computer-readable storage medium of claim 11 further storing instructions which, when executed by the processor, cause the processor to:

detect that a first image corresponding to the first file handle is mapped into a memory coupled to the processor;

determine an export symbol that is in a first set of export symbols in the first library but is not in a second set of export symbols in the second library; and

add a forwarding reference into the export section of the first image, wherein the forwarding reference corresponds to the export symbol in the second library.

13. The non-transitory computer-readable storage medium of claim 11 further storing instructions which, when executed by the processor, cause the processor to:

receive a second request from the loader to create a second file handle, wherein the second request includes a third identifier;

determine whether the third identifier in the second request is desired to be replaced with the first identifier;

responsive to determining that the third identifier in the second request is desired to be replaced with the first identifier, replace the third identifier in the second request with the first identifier;

create the second file handle based on the second request; and

provide the second file handle to the loader.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the first identifier is a first file system path corresponding to the first library, wherein the second identifier is a second file system path corresponding to the second library, and wherein the third identifier is a third file system path.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the third file system path is an invalid path.

16. The non-transitory computer-readable storage medium of claim 13 , wherein a second response corresponding to the second request includes the second file handle and the third identifier.

17. An apparatus, comprising:

a memory storing instructions; and

a processor, coupled to the memory and to execute the instructions, the instructions when executed cause the processor to:

receive a first request from a loader to create a first file handle corresponding to a first library, wherein the first request includes a first 6 identifier corresponding to the first library;

determine whether the first library is to be proxied by a second library;

responsive to determining that the first library is to be proxied by the second library, replace the first identifier in the first request with a second identifier corresponding to the second library;

create the first file handle based on the first request; and

provide the first file handle to the loader, wherein the providing the first file handle to the loader comprises replacing the second identifier with the first identifier in a first response corresponding to the first request.

18. The apparatus of claim 17 , wherein the instructions when executed cause the processor to:

detect that a first image corresponding to the first file handle is mapped into the memory; and

customize an export section of the first image based on a first set of export symbols in the first library and a second set of export symbols in the second library.

Assignments (2)
CHANGE OF NAME Recorded Mar 15, 2023
From: RIVERBED TECHNOLOGY, INC.
To: RIVERBED TECHNOLOGY LLC
Reel/Frame 063102/0699 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 15, 2022
From: DELIO, JOHN J., JR.
To: RIVERBED TECHNOLOGY, INC.
Reel/Frame 062110/0552 →
Continuity (1)
Provisional Application 63284573 · Nov 30, 2021
References Cited (12)
US 7162711B2 · Czajkowski · 2007 [cited by examiner]
US 8910148B2 · Bowyer · 2014 [cited by examiner]
US 9898615B1 · Evans · 2018 [cited by examiner]
US 20050108721A1 · Oshima · 2005 [cited by examiner]
US 20060080390A1 · Ung · 2006 [cited by examiner]
US 20070240171A1 · Biro · 2007 [cited by examiner]
US 20140282431A1 · Delio, Jr. · 2014 [cited by examiner]
US 20160205130A1 · Teller · 2016 [cited by examiner]
US 20220094760A1 · Jang · 2022 [cited by examiner]
Berdajs et al., “Extending applications using an advanced approach to DLL injection and API hooking,” Wiley & Sons, 2010, 18pg. (Year: 2010). [cited by examiner]
Lopez et al., “A Survey on Function and System Call Hooking Approaches,” Springer, 2017, 23pg. (Year: 2017). [cited by examiner]
Wang et al., “Lprov: Practical Library-aware Provenance Tracing,” ACM, 2018, 13pg. (Year: 2018). [cited by examiner]