US6463583B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Dynamic injection of execution logic into main dynamic link library function of the original kernel of a windowed operating system
Assignee: HP Inc
•
Filing: 1999-04-08
•
Granted: 2002-10-08
•
Expires: 2019-04-08
Abstract
Abstract Methods and system for dynamically injecting execution logic into shared memory spaces of a windowed operating system. An injection dynamic link library is loaded from an injection application into a pre-determined memory location within an area of shared memory within the windowed operating system. A main dynamic link library function within an original kernel dynamic link library including kernel functions for the windowed operating system is located from the injection dynamic link library. A jump command is inserted from injection dynamic link library within the main dynamic link library function in the kernel dynamic link library to create a modified kernel dynamic link library. The jump command jumps to an injection hook function within the injection dynamic link library whenever a new windowed operating system process is created. The injection hook function within the injection dynamic link library includes multiple injection functions that are executed by the windowed operating system prior to executing any other software applications whenever a new process is created in a windowed operating system. The methods and system of the present invention allow execution logic to be injected into new processes created by windowed operating systems using shared memory spaces such as Microsoft Windows 95/98. The execution logic is executed prior to any application software associated with the new processes. The methods and system of the present invention may be used for debugging aids, hooking other processes, tracing the execution of a process, and for other purposes.
Inventors
- 👤 Richard P. Hammond
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 19:26
CPC Classifications
G; G06; G06F; G06F9/00; G06F9/06; G06F9/44; G06F9/445; G06F9/44521; G06F11/00; G06F11/36; G06F11/362; G06F11/3644; G06F11/30; G06F11/34; G06F11/3466; G06F2201/00; G06F2201/865; G06F2209/00; G06F2209/54; G06F2209/542
Claims Analysis
Total Claims: 23
Claim 1
Independent Claim
228 words
In a computer system with a windowed operating system, a method of dynamically injecting execution logic, comprising the following steps: starting an injection application from a kernel application used by a windowed operating system; loading an injection virtual device driver from the injection application into a first pre-determined memory location in an area of shared memory in the windowed operating system, wherein the injection virtual device driver is used to alter protected areas of memory within the windowed operating system; loading an injection dynamic link library from the injection application into a second pre-determined memory location in an area of shared memory for the windowed operating system; locating a main dynamic link library function within an original kernel dynamic link library including kernel function for the windowed operating system; and inserting a jump command into the main dynamic link library function in the original kernel dynamic link library to create a modified kernel dynamic link library, wherein the jump command jumps to an injection hook function within the injection dynamic link library whenever a new windowed operating system process is created, and wherein the injection hook function within the injection dynamic link library includes a plurality of injection functions and that are executed by the windowed operating system prior to executing any other application related logic in a new process address space created by the windowed operating system.
Claim 2
Dependent Claim
228 words
In a computer system with a windowed operating system, a method of dynamically injecting execution logic, comprising the following steps: starting an injection application from a kernel application used by a windowed operating system; loading an injection virtual device driver from the injection application into a first pre-determined memory location in an area of shared memory in the windowed operating system, wherein the injection virtual device driver is used to alter protected areas of memory within the windowed operating system; loading an injection dynamic link library from the injection application into a second pre-determined memory location in an area of shared memory for the windowed operating system; locating a main dynamic link library function within an original kernel dynamic link library including kernel function for the windowed operating system; and inserting a jump command into the main dynamic link library function in the original kernel dynamic link library to create a modified kernel dynamic link library, wherein the jump command jumps to an injection hook function within the injection dynamic link library whenever a new windowed operating system process is created, and wherein the injection hook function within the injection dynamic link library includes a plurality of injection functions and that are executed by the windowed operating system prior to executing any other application related logic in a new process address space created by the windowed operating system.
Claim 3
Dependent Claim
22 words
A computer readable medium having stored therein instructions for causing a central processing unit to execute the method of claim 1 .
Claim 4
Dependent Claim
18 words
The method of claim 1 wherein the windowed operating system is any of Windows 95 or Windows 98.
Claim 5
Dependent Claim
61 words
The method of claim 1 the step of locating a main dynamic link library function within a dynamic link library including kernel functions for the windowed operating system from the injection dynamic link library includes locating a main dynamic link library function called DllMain within an original kernel dynamic link library including kernel functions called KERNEL32.DLL within the windowed operating system.
Claim 6
Dependent Claim
55 words
The method of claim 1 wherein the step of locating a main dynamic link library function within a dynamic link library including kernel functions for the windowed operating system from the injection application includes locating the main dynamic link library function with information from a header in the dynamic kernel link library including kernel functions.
Claim 7
Dependent Claim
27 words
The method of claim 5 wherein the header is a Portable Executable header from dynamic link library including kernel functions called KERNEL32.DLL within the windowed operating system.
Claim 8
Dependent Claim
70 words
The method of claim 1 wherein the step of loading an injection dynamic link library from the injection application into a second pre-determined memory location within an area of shared memory within the windowed operating system includes loading the injection dynamic link library into a memory location anywhere between memory addresses 0x80000000 and 0xBFFFFFFF within a four Giga-Byte area of memory allocated to a process within the windowed operating system.
Claim 9
Dependent Claim
87 words
The method of claim 1 wherein the step of inserting a jump command from the injection application within the main dynamic link library function in the original kernel dynamic link library to create a modified kernel dynamic link library further includes: replacing the original kernel dynamic link library with the modified kernel dynamic link library on the windowed operating system; and using the modified kernel dynamic link library on the windowed operating system for kernel services anytime a new process is requested on the windowed operating system.
Claim 10
Dependent Claim
32 words
The method of claim 1 wherein the area of shared memory for the windowed operating system is a four Giga-Byte area of memory allocated to a process within the windowed operating system.
Claim 11
Dependent Claim
13 words
The method of claim 1 wherein the new process is a Win32 process.
Claim 12
Dependent Claim
181 words
In a computer system with a windowed operating system, a method of using dynamically injected execution logic, comprising the following steps: receiving a request to create new process on a windowed operating system; accessing a modified kernel dynamic link library, including a modified main kernel dynamic link library function with jump command to jump to an injection hook function within an injection dynamic link library, from an area of shared memory within the windowed operating system, wherein the modified main kernel dynamic link library was modified by an injection application, and wherein the jump command in the main kernel dynamic link library function allows injection logic to be executed prior to executing any other applications related logic in a new process address space created by the windowed operating system; and executing the modified main dynamic link library function in the kernel dynamic link library to jump to the injection hook function within the injection dynamic link library to execute injection logic prior to executing any other applications related logic in a new process address space created by the windowed operating system.
Claim 13
Dependent Claim
181 words
In a computer system with a windowed operating system, a method of using dynamically injected execution logic, comprising the following steps: receiving a request to create new process on a windowed operating system; accessing a modified kernel dynamic link library, including a modified main kernel dynamic link library function with jump command to jump to an injection hook function within an injection dynamic link library, from an area of shared memory within the windowed operating system, wherein the modified main kernel dynamic link library was modified by an injection application, and wherein the jump command in the main kernel dynamic link library function allows injection logic to be executed prior to executing any other applications related logic in a new process address space created by the windowed operating system; and executing the modified main dynamic link library function in the kernel dynamic link library to jump to the injection hook function within the injection dynamic link library to execute injection logic prior to executing any other applications related logic in a new process address space created by the windowed operating system.
Claim 14
Dependent Claim
22 words
A computer readable medium having stored therein instructions for causing a central processing unit to execute the method of claim 11 .
Claim 15
Dependent Claim
33 words
The method of claim 11 wherein the modified kernel dynamic link library is a modified kernel dynamic link library called KERNEL32.DLL in the windowed operating system that was modified by an injection application.
Claim 16
Dependent Claim
45 words
The method of claim 11 wherein the modified main kernel dynamic link library function with jump command to jump to an injection hook function within an injection dynamic link library is a main kernel dynamic link library function called DllMain within the windowed operating system.
Claim 17
Dependent Claim
13 words
The method of claim 11 wherein the new process is a Win32 process.
Claim 18
Dependent Claim
18 words
The method of claim 11 wherein the windowed operating system is any of Windows 95 or Windows 98.
Claim 19
Dependent Claim
69 words
The method of claim 11 wherein the step of executing the modified main dynamic link library function in the kernel dynamic link library to jump to the injection hook function within the injection dynamic link library to execute injection logic includes executing functions within the injection hook function to track any of a process's existence, a process's usage of system resources, process debugging, process redirected or process termination requests.
Claim 20
Dependent Claim
54 words
The method of claim 11 wherein the step of executing the modified main dynamic link library function in the kernel dynamic link library to jump to the injection hook function within the injection dynamic link library to execute injection logic is executed for every new process created by the win do wed operating system.
Claim 21
Independent Claim
190 words
A system for dynamically injecting execution logic into a windowed operating system, comprising in combination: an injection application that loads an injection virtual device driver and an injection dynamic link library into areas of shared memory within a windowed operating system; an injection dynamic link library with a plurality of injection functions for executing injection logic and for modifying main kernel dynamic link library function in an original kernel dynamic link library with jump command to jump to an injection hook function within an injection dynamic link library, wherein the injection functions from the injection dynamic link library are used to execute injection logic prior to executing any other applications related logic in a new process address space created by a windowed operating system; an injection hook function for calling injection functions from an injection dynamic link library, wherein the injection hook function is called with a jump command inserted into a main dynamic link library function in a modified kernel dynamic link library loaded when a windowed operating system creates a new process; and an injection virtual device driver for altering protected memory areas within a windowed operating system.
Claim 22
Independent Claim
190 words
A system for dynamically injecting execution logic into a windowed operating system, comprising in combination: an injection application that loads an injection virtual device driver and an injection dynamic link library into areas of shared memory within a windowed operating system; an injection dynamic link library with a plurality of injection functions for executing injection logic and for modifying main kernel dynamic link library function in an original kernel dynamic link library with jump command to jump to an injection hook function within an injection dynamic link library, wherein the injection functions from the injection dynamic link library are used to execute injection logic prior to executing any other applications related logic in a new process address space created by a windowed operating system; an injection hook function for calling injection functions from an injection dynamic link library, wherein the injection hook function is called with a jump command inserted into a main dynamic link library function in a modified kernel dynamic link library loaded when a windowed operating system creates a new process; and an injection virtual device driver for altering protected memory areas within a windowed operating system.
Claim 23
Dependent Claim
18 words
The system of claim 19 wherein the windowed operating system is any of Windows 95 or Windows 98.
References Cited (Backward Citations)
US5535329A
Cited
US5583761A
Cited
US5673315A
Cited
EP0752647A1
Cited
US5812848A
Cited
US5960196A
Cited
WO1998033106A1
Cited
US6141698A
Cited
US5958010A
Cited
US6202199B1
Cited
US6075937A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-10-07 | 2006-04-08 | 2006-10-08 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-10-07 | 2010-04-08 | 2010-10-08 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-10-07 | 2014-04-08 | 2014-10-08 | $7700.00 | Window Closed / Lapsed |