Preserving dll hooks
AssigneeSentinelOne, Inc.
InventorsAnil Gupta, Harinath Vishwanath Ramchetty
Life of this patent
Estimating the term…
Abstract
DLL hooks are protected by mapping the starting address of the new executable to a sample of the former executable. Attempts to read the starting address are responded to with the sample of the former executable. Attempts to write to the starting address are responded to with confirmation of success without actually writing data. Debuggers are detected upon launch or by evaluating an operating system. A component executing in the kernel denies debugging privileges to prevent inspection and modification of DLL hooks.
Claims20
A method comprising:
- modifying memory to include a reference to a security dynamic link library (DLL) such that invocation of a function associated with a native DLL is redirected to the security DLL using the reference to the security DLL;
- generating an entry in a mapping, wherein the entry comprises the reference to the security DLL;
- receiving, from a source, instructions referencing an address in memory;
- and
- restricting the address in memory from access by the source based on a determination that the address in memory corresponds to the entry in the mapping.
A system comprising:
- a processing circuitry;
- and
- a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
- modify the memory to include a reference to a security dynamic link library (DLL) such that invocation of a function associated with a native DLL is redirected to the security DLL using the reference to the security DLL;
- generate an entry in a mapping, wherein the entry comprises the reference to the security DLL;
- receive, from a source, instructions referencing an address in the memory;
- and
- restrict the address in memory from access by the source based on a determination that the address in memory corresponds to the entry in the mapping.
A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a process for generating a representation for behavior determination, the process comprising:
- modifying memory to include a reference to a security dynamic link library (DLL) such that invocation of a function associated with a native DLL is redirected to the security DLL using the reference to the security DLL;
- generating an entry in a mapping, wherein the entry comprises the reference to the security DLL;
- receiving, from a source, instructions referencing an address in memory;
- and
- restricting the address in memory from access by the source based on a determination that the address in memory corresponds to the entry in the mapping.
Dependencies are inferred from the claim text.