Method and system for identifying and replacing system calls

Patent metadata

Field	Value
Publication number	US-9524154-B2
Application number	US-201313775047-A
Country	US
Kind code	B2
Filing date	Feb 22, 2013
Priority date	Aug 24, 2012
Publication date	Dec 20, 2016
Grant date	Dec 20, 2016

Abstract

One embodiment of the system disclosed herein facilitates identifying a system call in an application and replacing the identified system call with a customized function call. During operation, the system executes an executable file of the application, wherein the executable file has been modified to execute a hooking and injection manager at run time. Prior to executing the system call, the system executes the hooking and injection manager. While executing the hooking and injection manager, the system determines, from a symbol table, a symbol table index value corresponding to a symbol associated with the system call. The system further determines an import table entry storing a pointer to the system call based on the symbol table index value, and changes the pointer in the import table entry so that the pointer indicates an address of the customized function call.

First claim

What is claimed is:

1. A method for facilitating identifying a system call in an application and replacing the identified system call with a customized function call, comprising:
upon a launch of the application, loading a hooking and injection manager into a process of the application prior to loading any modules in the application that make system calls;
executing an executable file of the application, wherein the executable file has been modified to execute the hooking and injection manager at run time of the application, the hooking and injection manager including an interposition library configured to replace references to a system call with a respective reference to a customized function; and prior to the application making the system call:
determining, from a symbol table, symbol table index values corresponding to one or more symbols associated with each system call in the application;
determining, from an import table, an import table entry storing pointers to each respective system call based on corresponding symbol table index values;
if the import table is a lazy symbol table, searching through a load command section of an application object file for at least one load command for a pointer holding an address of an indirect table and the lazy symbol table, wherein the address of the indirect table is stored in a _lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _lazy_symbol_section in the load command section, and waiting until a respective system function call is called to change the pointers to each respective system call in the lazy symbol table so that the pointers to each respective system call are updated to indicate an address of the respective customized function call; and
if the import table is a non-lazy symbol table, searching through the load command section of the application object file for at least one load command for a pointer holding an address of the indirect table and the non-lazy symbol table, wherein the address of the indirect table is stored in a _non_lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _non_lazy_symbol_section in the load command section, and changing, prior to the application making the respective system call, the respective pointer to the respective system call in the non-lazy symbol table so that the respective pointer to the respective system call is updated to indicate the address of the respective customized function call.

2. The method of claim 1 , further comprising searching the executable file for a load command which indicates a location for a pointer to the import table.

3. The method of claim 1 , wherein the hooking and injection manager includes an interposition function which accepts as input a function name and an address for each customized function call.

4. The method of claim 1 , further comprising examining a load command to determine a size and location of the symbol table.

5. The method of claim 1 , wherein the executable file is a Mach-o file.

6. The method of claim 1 , wherein determining the import table entries storing the pointers to each of the system calls based on the symbol table index values comprises searching an indirect table for the import table entries that corresponds to the symbol table index values.

7. The method of claim 1 , wherein the hooking and injection manager is included in the executable file by a prior re-linking process.

8. The method of claim 1 , further comprising loading the hooking and injection manager by executing a load command added to the executable file.

9. The method of claim 1 , wherein the import table comprises a mapping from an index associated with a function symbol to an address for a function associated with the function symbol, and wherein the lazy symbol table includes only system calls that are called by the function symbol.

10. A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to perform a method for facilitating identifying a system call in an application and replacing the identified system call with a customized function call, the method comprising:
upon a launch of the application, loading a hooking and injection manager into a process of the application prior to loading any modules in the application that make system calls;
executing an executable file of the application, wherein the executable file has been modified to execute the hooking and injection manager at run time of the application; and
prior to the application making a system call:
determining, from a symbol table, symbol table index values corresponding to one or more symbols associated with each system call in the application;
determining, from an import table, an import table entry storing pointers to each respective system call based on corresponding symbol table index values;
if the import table is a lazy symbol table, searching through a load command section of an application object file for at least one load command for a pointer holding an address of an indirect table and the lazy symbol table, wherein the address of the indirect table is stored in a _lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _lazy_symbol_section in the load command section, and waiting until a respective system function call is called to change the pointers to each respective system call in the lazy symbol table so that the pointers to each respective system call are updated to indicate an address of the respective customized function call; and
if the import table is a non-lazy symbol table, searching through the load command section of the application object file for at least one load command for a pointer holding an address of the indirect table and the non-lazy symbol table, wherein the address of the indirect table is stored in a _non_lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _non_lazy_symbol_section in the load command section, and changing, prior to the application making the respective system call, the respective pointer to the respective system call in the non-lazy symbol table so that the respective pointer to the respective system call is updated to indicate the address of the respective customized function call.

11. The storage medium of claim 10 , wherein the method further comprises searching the executable file for a load command which indicates a location for a pointer to the import table.

12. The storage medium of claim 10 , wherein the hooking and injection manager includes an interposition function which accepts as input a function name and an address for each customized function call.

13. The storage medium of claim 10 , wherein the method further comprises examining a load command to determine a size and location of the symbol table.

14. The storage medium of claim 10 , wherein the executable file is a Mach-o file.

15. The storage medium of claim 10 , wherein determining the import table entry storing the pointers to the system calls based on the symbol table index values comprises searching an indirect table for the import table entries that corresponds to the symbol table index values.

16. The storage medium of claim 10 , wherein the hooking and injection manager is included in the executable file by a prior re-linking process.

17. The storage medium of claim 10 , wherein the method further compromises:
loading the hooking and injection manager by executing a load command added to the executable file.

Assignees

• Vmware Inc
• Airwatch Llc

Inventors

• Jawa Manish
• Tebeka Haim
• Newell Craig

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• H04W12/00

  Security arrangements; Authentication; Protecting privacy or anonymity · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title