Method for creating a revised application by adding code functionality to an existing application executable

An apparatus comprising:

• one or more processors;
• memory coupled to the one or more processors and configured to store instructions that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• obtaining a first binary of a software application, the first binary configured to perform a first set of functions;
• patching the first binary with an outgoing trampoline, the outgoing trampoline including a jump address;
• generating a hook trampoline, the hook trampoline configured to execute instructions overwritten by the outgoing trampoline in the first binary and to maintain a machine state associated with the overwritten instructions before a jump to a hook object;
• generating the hook object including the hook trampoline code, a hook implementation and a hook infrastructure, the hook implementation including one or more compiled source code elements implementing a second set of functions;
• loading, into a memory space, the patched first binary and the hook object and an offset table, the offset table including a hook address that is referenced by the jump address, the hook address referencing a location of the hook object in the memory space;
• and
• generating a second binary for the software application by combining the patched first binary and hook object, the second binary configured to perform the first set of functions and the second set of functions, wherein the second binary is a new binary for the software application.

A method comprising:

• executing, by a processor, a binary of a software application stored in memory, the binary including an outgoing trampoline, a hook object including a hook trampoline and an offset table including a hook address referencing a location of the hook object in the memory;
• executing, by the processor, a portion of the binary to perform a first function;
• executing, by the processor, the outgoing trampoline, the executing including obtaining the hook address from the offset table, and jumping to the location of the hook object in memory referenced by the hook address;
• executing, by the processor, the hook trampoline in the hook object, the executing including storing a state of the processor prior to executing the outgoing trampoline, executing instructions overwritten by the outgoing trampoline, executing instructions in the hook object to perform a second function different than the first function, and responsive to a return from the hook object, restoring the state of the processor that existed prior to the execution of the outgoing trampoline.