Method and system for facilitating replacement of system calls

Patent metadata

Field	Value
Publication number	US-10007782-B2
Application number	US-201715590582-A
Country	US
Kind code	B2
Filing date	May 9, 2017
Priority date	Aug 24, 2012
Publication date	Jun 26, 2018
Grant date	Jun 26, 2018

Abstract

One embodiment of the present invention provides system for facilitating replacement of a system function in an application with a customized function. During operation, the system shifts an existing load command in a file of an application to accommodate an additional load command. The system also adds the additional load command to the file. The additional load command identifies additional instructions that change a pointer of the application from a value that points to a system function to another value that points to a customized function.

First claim

Therefore, the following is claimed:

1. A non-transitory computer readable medium storing instructions for replacement of at least one system function in an application with at least one customized function that causes the application to enforce at least one policy, the instructions, when executed by at least one processor, cause the at least one processor to:
shift at least one existing load command in a file of the application away from a header of the file, the shift moving the at least one existing load command to a different location to accommodate at least one additional load command;
add the at least one additional load command to the file, wherein the at least one additional load command identifies additional instructions that when executed cause the at least one processor to change at least one pointer of the application from a first value that points to the at least one system function to second value that points to the at least one customized function; and
wherein the application is executed with the at least one customized function in an operating system to bypass at least one operating system restriction and enforce the at least one policy using the at least one customized function, and invocation of the at least one system function is preemptively redirected to the at least one customized function based at least in part on the at least one pointer that is changed.

2. The non-transitory computer readable medium of claim 1 , wherein when executed the instructions further cause the at least one processor to modify the header of the file to include a description of the at least one additional load command.

3. The non-transitory computer readable medium of claim 1 , wherein when executed the instructions further cause the at least one processor to:
shift at least one segment of a data portion in the file; and
update at least one offset corresponding to the at least one segment.

4. The non-transitory computer readable medium of claim 1 , wherein the at least one existing load command comprises a signature load command, and wherein when executed the instructions further cause the at least one processor to compute a new signature for the file and overwrite the signature load command.

5. The non-transitory computer readable medium of claim 1 , wherein the at least one pointer comprises a pointer defined in an import table for a library identified in the at least one existing load command.

6. The non-transitory computer readable medium of claim 1 , wherein the at least one pointer comprises a pointer defined in the file of the application.

7. The non-transitory computer readable medium of claim 1 , wherein when executed the additional instructions further cause the at least one processor to determine a symbol value associated with the at least one system function and reference a table that maps the symbol value to the at least one customized function to change the at least one pointer of the application.

8. A system for replacement of at least one system function in an application with at least one customized function that causes the application to enforce at least one policy, the system comprising:
at least one processor; and
a storage device storing instructions that when executed by the at least one processor, cause the at least one processor to:
shift at least one existing load command in a file of the application away from a header of the file, the shift moving the at least one existing load command to a different location to accommodate at least one additional load command;
add the at least one additional load command to the file, wherein the at least one additional load command identifies additional instructions that when executed cause the at least one processor to change at least one pointer of the application from a first value that points to the at least one system function to second value that points to the at least one customized function; and
wherein the application is executed with the at least one customized function in an operating system to bypass at least one operating system restriction and enforce the at least one policy using the at least one customized function, and invocation of the at least one system function is preemptively redirected to the at least one customized function based at least in part on the at least one pointer that is changed.

9. The system of claim 8 , wherein when executed the instructions further cause the at least one processor to modify the header of the file to include a description of the at least one additional load command.

10. The system of claim 8 , wherein when executed the instructions further cause the at least one processor to:
shift at least one segment of a data portion in the file; and
update at least one offset corresponding to the at least one segment.

11. The system of claim 8 , wherein the at least one existing load command comprises a signature load command, and wherein when executed the instructions further cause the at least one processor to compute a new signature for the file and overwrite the signature load command.

12. The system of claim 8 , wherein the at least one pointer comprises a pointer defined in an import table for a library identified in the at least one existing load command.

13. The system of claim 8 , wherein the at least one pointer comprises a pointer defined in the file of the application.

14. The system of claim 8 , wherein when executed the additional instructions further cause the at least one processor to determine a symbol value associated with the at least one system function and reference a table that maps the symbol value to the at least one customized custom function to change the at least one pointer of the application.

15. A computer-implemented method for replacement of at least one system function in an application with at least one customized function that causes the application to enforce at least one policy, the method comprising:
shifting at least one existing load command in a file of the application away from a header of the file, the shifting comprising moving the at least one existing load command to a different location to accommodate at least one additional load command;
adding the at least one additional load command to the file, wherein the at least one additional load command identifies additional instructions that when executed cause at least one processor to change at least one pointer of the application from a first value that points to the at least one system function to second value that points to the at least one customized function; and
wherein the application is executed with the at least one customized function in an operating system to bypass at least one operating system restriction and enforce the at least one policy using the at least one customized function, and invocation of the at least one system function is preemptively redirected to the at least one customized function based at least in part on the at least one pointer that is changed.

16. The computer-implemented method of claim 15 , further comprising modifying the header of the file to include a description of the at least one additional load command.

17. The computer-implemented method of claim 15 , further comprising:
shifting at least one segment of a data portion in the file; and
updating at least one offset corresponding to the at least one segment.

18. The computer-implemented method of claim 15 , wherein the at least one pointer comprises a pointer defined in an import table for a library identified in the at least one existing load command.

Assignees

• Vmware Inc

Inventors

• Jawa Manish
• Tebeka Haim
• Newell Craig

Classifications

• G06F2221/2149

  Restricted operating environment · CPC title

• G06F9/54

  Interprogram communication · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F8/54 Primary

  Link editing before load time · CPC title