Target process injection prior to execution of marker libraries

A non-transitory computer-readable storage medium comprising stored instructions, which when executed by a processor, cause the processor to:

• acquire a lock on a virtual memory of a target process, wherein the virtual memory of the target process includes import dependency data of a marker library;
• execute an injection driver at a passive level within the context of the target process when the marker library is loaded by the target process, wherein the executing the injection driver at the passive level within the context of the target process enables the injection driver to modify virtual memory tables within the target process;
• modify the import dependency data of the marker library to include an injection library as a dependency of the marker library, wherein a read operation is performed on a page table entry corresponding to the import dependency data in response to detecting that the page table entry does not exist;
• and
• after the modified import dependency data is used to load the injection library into the target process, revert the modified import dependency data to an original state, wherein loading the injection library into the target process modifies execution of the target process.

An apparatus comprising:

• a memory storing instructions;
• and
• a processor, coupled with the memory and to execute the instructions, the instructions when executed cause the processor to:
• acquire a lock on a virtual memory of a target process, wherein the virtual memory of the target process includes import dependency data of a marker library;
• execute an injection driver at a passive level within the context of the target process, wherein the executing the injection driver at a passive level within the context of the target process enables the injection driver to modify virtual memory tables within the target process;
• detect loading of the marker library;
• modify the import dependency data of the marker library to include an injection library as a dependency of the marker library, wherein a read operation is performed on a page table entry corresponding to the import dependency data in response to detecting that the page table entry does not exist;
• and
• after the modified import dependency data is used to load the injection library into the target process, revert the modified import dependency data to an original state, wherein loading the injection library into the target process modifies execution of the target process.