US 11,892,939 B2 · Automatic injection of agents into processes executing statically linked binaries

Abstract

A system and method is disclosed for injecting in-process agents into processes executing self-contained, statically linked binaries that do not interact with a dynamic loader mechanism that identifies and resolves required libraries at run time. System calls directed to the execution of binaries in processes are intercepted and the targeted binary is analyzed to determine whether it is statically linked. In case a statically linked binary is identified, a proxy launcher process is started instead of the binary which starts the original binary as traceable child process. After the child process has loaded the original binary into its process memory, the memory image of the child process is copied to the launcher process and the child process is terminated. An agent is loaded into the launcher process to instruments the copied memory image. After the instrumentation is finished, the original start conditions for the statically linked binary are reconstructed and the entry function of the instrumented statically linked binary is called to execute the binary.

Claims24

Dependent claims

A computer-implemented system for injecting agents into processes executing on a host computer, comprising:

a given binary available for execution of the host computer;
and
an interceptor instrumented in a first process running under an operating system on the host computer and configured to receive a request to execute the given binary, wherein the interceptor analyzes the given binary to determine linking status and, in response to a determination that the given binary is statically linked to, launches a proxy launcher in a proxy process of an execution environment managed by the operating system;
wherein the proxy launcher copies a memory image of the given binary into a memory assigned to the proxy process, loads a monitoring agent into the proxy process and starts execution of the memory image of the given binary in the proxy process, where the proxy launcher is implemented by executable instructions stored in a non-transitory data store of the host computer and the monitoring agent instruments the memory image of the given binary in the proxy process, monitors execution of the given binary and sends performance data describing execution of the given binary across a network to a monitor server.

1 more element

A computer-implemented method for injecting agents into process executing on a host computer, comprising:

receiving, by an interceptor, a request to execute a given binary, where the interceptor is instrumented in a first process running under an operating system on the host computer;
analyzing, by the interceptor, the given binary to determine linking status for the given binary;
launching, by the interceptor, a proxy launcher in a proxy process of an execution environment managed by the operating system, where the proxy launcher is launched in response to a determination that the given binary is statically linked to;
launching, by the proxy launcher, a child process for executing the given binary;
copying, by the operating system, a memory image of the given binary into a memory assigned to the child process;
copying, by the proxy launcher, a memory image of the given binary from the child process to a memory assigned to the proxy process;
loading, by the proxy launcher, a monitoring agent into the proxy process, where the monitoring agent instruments the memory image of the given binary in the proxy process;
and
starting, by the proxy launcher, execution of the memory image of the given binary in the proxy process.

6 more elements

Dependencies are inferred from the claim text.

Automatic injection of agents into processes executing statically linked binaries

Life of this patent

Automatic injection of agents into processes executing statically linked binaries

Life of this patent

Abstract

Claims24