Riverbed Technology, Inc.

Other

John J Delio, Jr

A first request may be received from a loader to create a first file handle corresponding to a first library, where the first request may include a first identifier corresponding to the first library, and where the loader may be part of an operating system of a computer system. It may be determined that the first library is to be proxied by a second library. The first identifier in the first request may be replaced with a second identifier corresponding to the second library. The first file handle may be created based on the first request. The first file handle may be provided to the loader. An export section of a first image corresponding to the first file handle may be customized when the first image is mapped into a memory.

Zero modification export hooking

A lock may be acquired on a virtual memory of a target process, where the virtual memory of the target process may include import dependency data of a marker library. An injection driver may be executed within the context of the target process when the marker library is loaded by the target process, where executing the injection driver within the context of the target process may enable the injection driver to modify virtual memory tables within the target process. The import dependency data of the marker library may be modified by the injection driver to include an injection library as a dependency of the marker library. After the modified import dependency data is used to load the injection library into the target process, the modified import dependency data may be reverted to an original state.

Target process injection prior to execution of marker libraries

The disclosed embodiments provide a system that modifies execution of a target process in a computer system. During loading of a marker library by a target process, the system modifies import dependency data of the marker library to include an injection library as a dependency of a marker library. After the modified import dependency data is used to load the injection library into the target process by the operating system or loader, the system executes the injection library prior to execution of the marker library to revert the import dependency data to an original state and modify execution of the target process.

Systems and techniques are described for controlling injection of a library into a process. Specifically, some embodiments provide an Advanced Injection Rule Engine (AIRE), which uses a set of rules to selectively inject a library, e.g., a dynamic-link library (DLL), into a process. Some embodiments implement a Domain Specific Language (DSL), called AIRE Script, to define the injection rules that are used by the AIRE at runtime.

Advanced injection rule engine

Systems and techniques are described for compressing strings by using a tree data structure. Specifically, for each string in a sequence of strings, the embodiments can traverse the tree data structure by matching characters of the string with characters associated with nodes of the tree data structure until either (1) all characters in the string have been processed, or (2) a current character in the string does not match a corresponding character in a current node of the tree data structure. Next, a first node identifier associated with the current node can be returned if all characters have been processed. Otherwise, a new node can be created in the tree data structure to store the remaining characters in the string, and a second node identifier associated with the new node in the tree data structure can be returned.

Prefix compression for keyed values

Embodiments provide systems, methods, and computer program products for dynamically hooking multiple levels of application code. A server receives identifying information that identifies a target function of a target application to hook. The server pauses a target process of the target application. The server locates the target function within the target application code based on the received identifying information. The server then hooks the located function outside of the target application, thereby creating hooked code during application runtime.

Native code profiler framework

A disposable spoon having a hollow main housing with a spoon that is releasably attached to the main housing. When the user places a food packet inside the main housing, the spoon pierces the food packet. A movable extruder actuator is operatively attached to an extruder blade. When the user slides the movable extruder actuator, the extruder blade compresses the food packet causing the contents of the food packet to extruded from the food packet and onto the spoon.

Growing community of inventors

Manchester, NH, United States of America

John J Delio, Jr