초록 ▼

A method and system for modifying the behavior of existing executable code by injecting new code into an executable file is provided. The injection mechanism injects a reference to new code contained in a DLL into an existing executable file such that, when the code of the executable file is execute

A method and system for modifying the behavior of existing executable code by injecting new code into an executable file is provided. The injection mechanism injects a reference to new code contained in a DLL into an existing executable file such that, when the code of the executable file is executed, the DLL is automatically loaded and the new code is automatically executed. A reference to the DLL is injected into the executable file by either modifying an import table of the file, which causes automatic loading of the DLLs referred to therein, or by adding DLL loader code to the file. The DLLs loader code uses an underlying operating system call to load the DLL. Further, the injection mechanism provides enhanced security by injecting security code and data into the executable file. The injected security code mechanism uses an incremental encryption and decryption process to encrypt and decrypt portions of the executable file in a more secure manner.

대표청구항 ▼

[ What is claimed:] [1.] A method in a computer system for modifying an existing executable file so that when the executable file is loaded into memory for execution, control is transferred to an injected dynamic link library prior to transferring control to a main entry point of the executable file

[ What is claimed:] [1.] A method in a computer system for modifying an existing executable file so that when the executable file is loaded into memory for execution, control is transferred to an injected dynamic link library prior to transferring control to a main entry point of the executable file, the executable file having an import table indicating each dynamic link library to be mapped and loaded into memory when the executable file is loaded for execution, wherein when a dynamic link library is mapped into memory a main library function of the dynamic link library is executed, the method comprising:creating the injected dynamic link library with a main library function, the main library function for performing a certain behavior that is not part of the unmodified executable file; andadding to the import table of the executable file an indication of the injected link library so that when the executable file is loaded into memory control is transferred to the main library function of the dynamic link library to execute the certain behavior prior to transferring control to the main entry point of the executable file.