Preserving DLL hooks
AssigneeSentinelOne, Inc.
InventorsAnil Gupta, Harinath Vishwanath Ramchetty
Life of this patent
Estimating the term…
Abstract
DLL hooks are protected by mapping the starting address of the new executable to a sample of the former executable. Attempts to read the starting address are responded to with the sample of the former executable. Attempts to write to the starting address are responded to with confirmation of success without actually writing data. Debuggers are detected upon launch or by evaluating an operating system. A component executing in the kernel denies debugging privileges to prevent inspection and modification of DLL hooks.
Claims18
A method performed by a computer system, the method comprising:
- modifying memory to include a reference to a security dynamic link library (DLL) such that invocation of a function associated with a native DLL is redirected to the security DLL using the reference to the security DLL, the security DLL being different from the native DLL and invoking performance of a threat mitigation function that the native DLL is not programmed to perform;
- generating an entry in a mapping, wherein the entry comprises the reference to the security DLL and a representation of the native DLL;
- receiving, from a source, instructions referencing an address in memory;
- and
- restricting the address in memory from direct access by the source based on a determination that the address in memory corresponds to the entry in the mapping, wherein restricting the address in the one or more memory devices from direct access by the source comprises restricting access to the reference to the security DLL by modifying an operating system to restrict use of debugging privileges.
A system comprising one or more processing devices and one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code effective to cause the one or more processing devices to:
- modify memory to include a reference to a security dynamic link library (DLL) such that invocation of a function associated with a native DLL is redirected to the security DLL using the reference to the security, DLL, the security DLL being different from the native DLL and invoking performance of a threat mitigation function that the native DLL is not programmed to perform;
- receive, from a source, instructions referencing an address in the one or more memory devices;
- and
- restrict the address in the one or more memory devices from direct access by the source based on a determination that the address in the one or more memory devices corresponds to the entry in the mapping, wherein restricting the address in the one or more memory devices from direct access by the source comprises restricting access to the reference to the security DLL by modifying an operating system to restrict use of debugging privileges.
Dependencies are inferred from the claim text.