US5953534A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Environment manipulation for executing modified executable and dynamically-loaded library files
Assignee: WASHINGTON, University of
•
Filing: 1997-12-23
•
Granted: 1999-09-14
•
Expires: 2017-12-23
Abstract
Abstract A method and procedure for modifying modules comprising a binary executable software program in such a way that, despite the transformations performed and the creation of new versions of the modules, the transformed program appears (to that program, including all of its components) as if it is running in the identical environment as the original program. The environment includes environment variables, the name of the program, the names of all of the dynamically loaded library (DLL) files that the program references, the directory in which the program resides, and the current directory at the time the program started execution. When the program has been transformed, e.g., for the purposes of monitoring or measurement, the environment also includes the effective addresses of data and instruction references made by the program. By employing the present invention, a modified software program will have the same behavior as the original unmodified program from which it is derived, even though it and many of its environment characteristics have been changed.
Inventors
- 👤 Theodore H. Romer
- 👤 Alastair Wolman
- 👤 Dennis Chua Lee
- 👤 Geoffrey Michael Voelker
- 👤 Brian N. Bershad
- 👤 John Bradley Chen
- 👤 Henry M. Levy
- 👤 Wayne Anthony Wong
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-07 16:19
CPC Classifications
G; G06; G06F; G06F11/00; G06F11/30; G06F11/34; G06F11/3466
Claims Analysis
Total Claims: 30
Claim 1
Independent Claim
247 words
A method for modifying an original software program to produce a transformed software program that implements a new functionality not provided by the original software program, as well as functions of the original software program, comprising the steps of: (a) determining all executable components included in or referenced by the original software program; (b) creating a new environment for the modified executable program by: (i) modifying one or more executable components to implement the new functionality not provided by the original software program, producing corresponding one or more modified executable components; (ii) extracting an original import table from each executable component comprising the original software program; and (iii) creating a new import table from the original import table for an executable component, if the original import table includes a reference to a modified executable component, said new import table including a reference to each modified executable component instead of the executable component to which said modified executable component corresponds; and (c) dynamically emulating an environment of the original software program when executing the transformed software program by: (i) intercepting calls to load any executable component that has been modified and determining a name for the modified executable component corresponding to the executable component being loaded; and (ii) loading each modified executable component for execution instead of the executable component to which it corresponds, thereby enabling the transformed software program to substantially carry out the functions implemented by the original software program, in addition to said new functionality.
Claim 2
Independent Claim
247 words
A method for modifying an original software program to produce a transformed software program that implements a new functionality not provided by the original software program, as well as functions of the original software program, comprising the steps of: (a) determining all executable components included in or referenced by the original software program; (b) creating a new environment for the modified executable program by: (i) modifying one or more executable components to implement the new functionality not provided by the original software program, producing corresponding one or more modified executable components; (ii) extracting an original import table from each executable component comprising the original software program; and (iii) creating a new import table from the original import table for an executable component, if the original import table includes a reference to a modified executable component, said new import table including a reference to each modified executable component instead of the executable component to which said modified executable component corresponds; and (c) dynamically emulating an environment of the original software program when executing the transformed software program by: (i) intercepting calls to load any executable component that has been modified and determining a name for the modified executable component corresponding to the executable component being loaded; and (ii) loading each modified executable component for execution instead of the executable component to which it corresponds, thereby enabling the transformed software program to substantially carry out the functions implemented by the original software program, in addition to said new functionality.
Claim 3
Dependent Claim
58 words
The method of claim 1, further comprising the steps of: (a) intercepting calls that return the name for any executable component that has been modified; (b) determining an original name of the executable component corresponding to the executable component that was modified; and (c) returning the original name of the executable component determined in the preceding step (b).
Claim 4
Dependent Claim
61 words
The method of claim 1, wherein the step of extracting the original import table from each of the executable components comprising the original software program includes the steps of: (a) parsing a file header of said executable components comprising the original software program; and (b) constructing the original import table from information contained in the file header of said executable components.
Claim 5
Dependent Claim
64 words
The method of claim 1, wherein the step of determining the executable components included in the original software program comprises the steps of: (a) parsing the original import table for each previously identified executable component, to identify additional executable components; (b) parsing an original import table for the additional executable components; and (c) repeating these steps until no additional executable components can be identified.
Claim 6
Dependent Claim
46 words
The method of claim 1, wherein the step of determining all executable components included in or referenced by the original software program comprises the steps of: (a) executing the original software program; and (b) detecting calls to load the executable components so that they are identified.
Claim 7
Dependent Claim
73 words
The method of claim 1, further comprising the step of providing modified library functions for corresponding library functions in an operating system under which the transformed software program executes, said modified library functions providing additional functionality enabling modifications to the original software program to be concealed when the transformed software program executes and ensuring that the modified executable components are loaded instead of the corresponding executable components included in the original software program.
Claim 8
Dependent Claim
39 words
The method of claim 6, further comprising the step of adding a runtime wrapper module to each of the new import tables, said runtime wrapper module providing system calls to the modified library functions to handle modified executable components.
Claim 9
Dependent Claim
44 words
The method of claim 1, further comprising the step of translating addresses for instructions and operands used in the modified executable components to compensate for changes in size of the modified executable components relative to the corresponding executable components in the original software program.
Claim 10
Dependent Claim
59 words
The method of claim 8, wherein the step of translating addresses is accomplished when the transformed software program is executed, further comprising the step of creating a mapping table for each modified executable component that is used to map address offsets in the modified executable component into address offsets in the executable component corresponding to the modified executable component.
Claim 11
Dependent Claim
93 words
The method of claim 1, wherein if the original software program employs an executable component that cannot be statically transformed and which includes a pointer to a modified executable component, further comprising the steps of: (a) providing a husk component having a position in a virtual memory address space identical to a position originally occupied by the executable component to which said modified executable component corresponds; and (b) including jumps to addresses in the modified executable component corresponding to procedure entry points in said executable component to which said modified executable component corresponds.
Claim 12
Independent Claim
213 words
A method for creating a transformed software program from an original software program so that the transformed software program provides a new functionality, while retaining an underlying functionality of the original software program in the transformed software program, comprising the steps of: (a) evaluating an environment of the original software program to identify all executable modules that are included therein; (b) to carry out the new functionality, doing at least one of the following: (i) modifying at least one executable module; and (ii) adding a new executable module; (c) modifying any executable module identified as required to substantially emulate and maintain the underlying functionality of the original software program, by performing the steps of: (i) identifying each executable module on the list of the executable modules that must be modified to implement the new functionality; (ii) modifying the executable modules that are identified, creating modified executable modules corresponding to the executable modules identified; and (iii) parsing an import table of each of the executable modules to determine if any executable module that has been modified is called in the import table, and if so, creating a new import table that instead calls the modified executable module; and (d) saving any modified executable modules so that they are callable by the transformed software program.
Claim 13
Independent Claim
213 words
A method for creating a transformed software program from an original software program so that the transformed software program provides a new functionality, while retaining an underlying functionality of the original software program in the transformed software program, comprising the steps of: (a) evaluating an environment of the original software program to identify all executable modules that are included therein; (b) to carry out the new functionality, doing at least one of the following: (i) modifying at least one executable module; and (ii) adding a new executable module; (c) modifying any executable module identified as required to substantially emulate and maintain the underlying functionality of the original software program, by performing the steps of: (i) identifying each executable module on the list of the executable modules that must be modified to implement the new functionality; (ii) modifying the executable modules that are identified, creating modified executable modules corresponding to the executable modules identified; and (iii) parsing an import table of each of the executable modules to determine if any executable module that has been modified is called in the import table, and if so, creating a new import table that instead calls the modified executable module; and (d) saving any modified executable modules so that they are callable by the transformed software program.
Claim 14
Dependent Claim
45 words
The method of claim 11, wherein the step of evaluating the environment of the original software program comprises the steps of: (a) executing the original software program; and (b) writing a list of the executable modules that are loaded as the original software program executes.
Claim 15
Dependent Claim
73 words
The method of claim 11, wherein the step of evaluating the environment of the original software program comprises the steps of: (a) identifying an initial executable module; (b) analyzing an import table of the initial executable module to identify another executable module referenced therein; (c) repetitively analyzing the import table of successive executable modules that are identified, to identify additional executable modules; and (d) writing a list of the executable modules thus identified.
Claim 16
Dependent Claim
56 words
The method of claim 11, wherein the step of modifying an executable module as required to emulate and maintain the underlying functionality of the original software program comprises the step of adding a runtime wrapper module to the new import table, said runtime wrapper module referencing revised library function modules instead of original library function modules.
Claim 17
Dependent Claim
72 words
The method of claim 11, wherein the step of modifying any executable module identified, as required to emulate and maintain the underlying functionality of the original software program, further comprises the step of creating an address lookup table to indicate changes in addressing of the modified executable modules, which step is required due to differences in a size of each modified executable module relative to a size of its corresponding executable module.
Claim 18
Independent Claim
224 words
A system for creating a transformed software program from an original software program so that the transformed software program provides a new functionality, while retaining an underlying functionality of the original software program, comprising: (a) a memory for storing machine instructions, said machine instructions defining a plurality of functions; and (b) a processor that executes the machine instructions stored in the memory, said machine instructions causing the processor to: (i) evaluate an environment of the original software program to identify all executable modules that are included or referenced therein; (ii) provide the new functionality by doing at least one of the following: (1) modifying an executable module; and (2) adding a new executable module; (iii) emulate and maintain the underlying functionality of the original software program by modifying any executable module as required, by: (1) identifying the executable modules on the list of the executable modules that must be modified to provide the new functionality; and (2) parsing an import table of each of the executable modules to determine if any executable module that has been modified is called in the import table, and if so, creates a new import table in the memory that instead calls the modified executable module; and (iv) save each modified executable module in the memory, so that the modified executable module is callable by the transformed software program.
Claim 19
Independent Claim
224 words
A system for creating a transformed software program from an original software program so that the transformed software program provides a new functionality, while retaining an underlying functionality of the original software program, comprising: (a) a memory for storing machine instructions, said machine instructions defining a plurality of functions; and (b) a processor that executes the machine instructions stored in the memory, said machine instructions causing the processor to: (i) evaluate an environment of the original software program to identify all executable modules that are included or referenced therein; (ii) provide the new functionality by doing at least one of the following: (1) modifying an executable module; and (2) adding a new executable module; (iii) emulate and maintain the underlying functionality of the original software program by modifying any executable module as required, by: (1) identifying the executable modules on the list of the executable modules that must be modified to provide the new functionality; and (2) parsing an import table of each of the executable modules to determine if any executable module that has been modified is called in the import table, and if so, creates a new import table in the memory that instead calls the modified executable module; and (iv) save each modified executable module in the memory, so that the modified executable module is callable by the transformed software program.
Claim 20
Dependent Claim
44 words
The system of claim 16, wherein to evaluate the environment of the original software program, the processor: (a) executes the original software program; and (b) writes a list of the executable modules that are loaded as the original software program executes, into the memory.
Claim 21
Dependent Claim
69 words
The system of claim 16, wherein to evaluate the environment of the original software program, the processor: (a) identifies an initial executable module; (b) analyzes an import table of the initial executable module, to identify another executable module referenced therein; (c) repetitively analyzes the import table of successive executable modules, to identify additional executable modules; and (d) writes a list of the executable modules thus identified into the memory.
Claim 22
Dependent Claim
53 words
The system of claim 16, wherein to modify an executable module as required to emulate and maintain the underlying functionality of the original software program, the processor adds a runtime wrapper module to the new import table that references revised library function modules stored in the memory instead of original library function modules.
Claim 23
Dependent Claim
63 words
The system of claim 16, wherein to modify an executable module as required to emulate and maintain the underlying functionality of the original software program, the processor further creates an address lookup table that indicates changes in addressing of the modified executable modules, which is required due to changes in a size of any modified executable module relative to its corresponding executable module.
Claim 24
Dependent Claim
96 words
The system of claim 16, wherein if the original software program employs an executable component that cannot be statically transformed and which includes a pointer to a modified executable module, the machine instructions further cause the processor to: (a) provide a husk module having a position in a virtual memory address space identical to a position originally occupied by an executable module to which said modified executable component corresponds; and (b) include jumps to addresses in the modified executable module corresponding to procedure entry points in said executable module to which said modified executable component corresponds.
Claim 25
Dependent Claim
238 words
An article of manufacture adapted to be used with a computer to create a transformed software program from an original software program so that the transformed software program provides a new functionality, while maintaining an underlying functionality of the original software program in the transformed software program, comprising: (a) a storage media adapted to be read by a computer; and (b) a plurality of machine instructions stored on the storage media, said machine instructions, when executed by the computer, causing the computer to: (i) evaluate an environment of the original software program to identify all executable modules that are included therein; (ii) do at least one of the following as required to provide the new functionality: (1) modify an executable module that was identified; and (2) add a new executable module; (iii) modify any executable module identified as required to emulate and maintain the underlying functionality of the original software program by: (1) identifying any executable modules on the list of the executable modules that must be modified to implement the new functionality; and (2) parsing an import table of each of the executable modules to determine if any executable module that has been modified is called in the import table, and if so, create a new import table that instead calls the modified executable module; and (iv) save any modified executable modules and any new executable modules so that they are callable by the transformed software program.
Claim 26
Dependent Claim
238 words
An article of manufacture adapted to be used with a computer to create a transformed software program from an original software program so that the transformed software program provides a new functionality, while maintaining an underlying functionality of the original software program in the transformed software program, comprising: (a) a storage media adapted to be read by a computer; and (b) a plurality of machine instructions stored on the storage media, said machine instructions, when executed by the computer, causing the computer to: (i) evaluate an environment of the original software program to identify all executable modules that are included therein; (ii) do at least one of the following as required to provide the new functionality: (1) modify an executable module that was identified; and (2) add a new executable module; (iii) modify any executable module identified as required to emulate and maintain the underlying functionality of the original software program by: (1) identifying any executable modules on the list of the executable modules that must be modified to implement the new functionality; and (2) parsing an import table of each of the executable modules to determine if any executable module that has been modified is called in the import table, and if so, create a new import table that instead calls the modified executable module; and (iv) save any modified executable modules and any new executable modules so that they are callable by the transformed software program.
Claim 27
Dependent Claim
48 words
The article of manufacture of claim 22, wherein to evaluate the environment of the original software program, the machine instructions cause the computer to: (a) execute the original software program; and (b) write a list of the executable modules that are loaded as the original software program executes.
Claim 28
Dependent Claim
71 words
The system of claim 22, wherein to evaluate the environment of the original software program, the machine instructions cause the computer to: (a) identify an initial executable module; (b) analyze an import table of the initial executable module to identify another executable module referenced therein; (c) repetitively analyze the import table of successive executable modules to identify additional executable modules; and (d) write a list of the executable modules thus identified.
Claim 29
Dependent Claim
56 words
The article of manufacture of claim 22, wherein to modify any executable module as required to emulate and maintain the underlying functionality of the original software program, the machine instructions cause the computer to add a runtime wrapper module to the new import table that references revised library function modules instead of original library function modules.
Claim 30
Dependent Claim
69 words
The article of manufacture of claim 22, wherein to modify any executable module as required to emulate and maintain the underlying functionality of the original software program, the machine instructions cause the computer to create an address lookup table to indicate changes in addressing of the modified executable modules, which is required due to differences in a size of any modified executable module relative to its corresponding executable module.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2002-09-13 | 2003-03-15 | 2003-09-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2006-09-13 | 2007-03-15 | 2007-09-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2010-09-13 | 2011-03-15 | 2011-09-14 | $7700.00 | Window Closed / Lapsed |