US 2025/0028623 A1 · TECHNIQUES FOR MONITORING USAGE OF A DYNAMICALLY BOUND METHOD OF A SOFTWARE OBJECT

Abstract

In example embodiments, techniques are provided to monitor usage of a dynamically bound method (e.g., COM interface) of a software object (e.g., COM object). A copy of a virtual method table for the software object is created, wherein the virtual method table includes a method pointer to the dynamically bound method. The virtual method table is then modified to change the method pointer to an address of a hook function. In response to a call to the dynamically bound method, the hook function is called using the changed method pointer in the modified virtual method table. The hook function determines an address of the software object using a reference variable, uses the address of the software object to access the saved copy of the virtual method table, and calls the dynamically bound method using the method pointer from the saved copy of the virtual method table.

Claims20

Dependent claims

A method for monitoring usage of a dynamically bound method of a software object, comprising:

saving, to a memory of a computing device, a copy of a virtual method table for the software object, wherein the virtual method table includes a method pointer to the dynamically bound method;
modifying, by the computing device, the virtual method table to change the method pointer to an address of a hook function;
and
in response to a call on the computing device to the dynamically bound method,
calling the hook function using the changed method pointer in the modified virtual method table,
determining, by the hook function, an address of the software object using a reference variable that refers to a current object of the dynamically bound method as a parameter,
using the address of the software object to access the saved copy of the virtual method table, and
calling the dynamically bound method using the method pointer from the saved copy of the virtual method table.

5 more elements

An apparatus for monitoring usage of a dynamically bound method of a software object, comprising:

one or more processors configured to execute software;
and
one or more memories coupled to the one or more processors, the one or more memories configured to store software of a hooking process and a hook function, wherein the hooking process when executed on the one or more processors is operable to:
save a copy of a virtual method table for the software object, wherein the virtual method table includes a method pointer to the dynamically bound method, and
modify the virtual method table to change the method pointer to an address of the hook function, and
wherein the hook function when executed on the one or more processors in response to being called via the changed method pointer in the modified virtual method table is operable to:
determine an address of the software object using a reference variable that refers to a current object of the dynamically bound method as a parameter,
use the address of the software object to access the saved copy of the virtual method table,
call the dynamically bound method using the method pointer from the saved copy of the virtual method table,
record one or more parameters of the call to the dynamically bound method, and
provide the one or more parameters to a threat management facility.

8 more elements

Dependencies are inferred from the claim text.

Techniques for monitoring usage of a dynamically bound method of a software object

Life of this patent

Techniques for monitoring usage of a dynamically bound method of a software object

Life of this patent

Abstract

Claims20