Dynamic instrumentation to capture cleartext from transformed communications
AssigneeSysdig, Inc.
InventorsGianluca Borello, Loris Degioanni
Life of this patent
Estimating the term…
Abstract
Techniques for dynamically instrumenting code to capture cleartext from transformed communications are provided. In one technique, an operating system (OS) mechanism receives an OS call. The OS mechanism determines whether the OS call is of a particular type. In response to determining that the OS call is of the particular type, a certain location within executable code of a unction is identified. A user-level collection mechanism is inserted at the certain location. After inserting the user-level collection mechanism, code at the certain location is executed that causes the user-level collection mechanism to be executed.
Claims17
A method comprising:
- receiving, by an operating system (OS) mechanism within an OS, an OS call;
- determining, by the OS mechanism, whether the OS call is of a particular type, the particular type indicating that a new user process is to be executed or that a new mapping in a virtual address space is to be created;
- in response to determining that the OS call is of the particular type, identifying a certain location within executable code of a user-level call associated with the OS call, the certain location being a location for the user-level call to be invoked as a result of invoking the OS call, the user-level call involving transforming cleartext data to ciphertext data and transmitting the ciphertext data over a computer network without the cleartext data being transmitted;
- inserting a user-level collection mechanism at the certain location within the executable code of the user-level call;
- after inserting the user-level collection mechanism, executing code at the certain location that causes the user-level collection mechanism to be executed, along with transform of the clear text data to the ciphertext data and transmission of the ciphertext data over the computer network,
- wherein executing the user-level collection mechanism causes the cleartext data, which is associated with the certain location, to be collected and transmitted to a system-level collection mechanism that is associated with the inserted user-level collection mechanism and executed within a kernel space of the OS;
- and
- exporting the cleartext data from the kernel space of the OS to a user space, and monitoring or analyzing the exported cleartext data in the user space for system analysis,
- wherein the method is performed by one or more computing devices.
One or more non-transitory storage media storing instructions which, when executed by one or more processors, cause:
- receiving, by an operating system (OS) mechanism within an OS, an OS call;
- determining, by the OS mechanism, whether the OS call is of a particular type, the particular type indicating that a new user process is to be executed or that a new mapping in a virtual address space is to be created;
- in response to determining that the OS call is of the particular type, identifying a certain location within executable code of a user-level call associated with the OS call, the certain location being a location for the user-level call to be invoked as a result of invoking the OS call, the user-level call involving transforming cleartext data to ciphertext data and transmitting the ciphertext data over a computer network without the cleartext data being transmitted;
- inserting a user-level collection mechanism at the certain location within the executable code of the user-level call;
- after inserting the user-level collection mechanism, executing code at the certain location that causes the user-level collection mechanism to be executed, along with transform of the clear text data to the ciphertext data and transmission of the ciphertext data over the computer network,
- wherein executing the user-level collection mechanism causes the cleartext data, which is associated with the certain location, to be collected and transmitted to a system-level collection mechanism that is associated with the inserted user-level collection mechanism and executed within a kernel space of the OS;
- and
- exporting the cleartext data from the kernel space of the OS to a user space, and monitoring or analyzing the exported cleartext data in the user space for system analysis.
Dependencies are inferred from the claim text.