CN107193538A - A kind of improved method and device for hooking up technology - Google Patents
A kind of improved method and device for hooking up technology Download PDFInfo
- Publication number
- CN107193538A CN107193538A CN201610143092.8A CN201610143092A CN107193538A CN 107193538 A CN107193538 A CN 107193538A CN 201610143092 A CN201610143092 A CN 201610143092A CN 107193538 A CN107193538 A CN 107193538A
- Authority
- CN
- China
- Prior art keywords
- address
- system program
- program
- entrance
- bytes
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/30—Arrangements for executing machine instructions, e.g. instruction decode
- G06F9/32—Address formation of the next instruction, e.g. by incrementing the instruction counter
Landscapes
- Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a kind of improved method and device for hooking up technology.A kind of improved method for hooking up technology, including：When monitoring that system program is hooked up, content of the system program using entry address as continuous two bytes of starting is changed；According to the amended system program using entry address as the content of continuous two bytes of starting, the entry address of injecting program is jumped to；After the injecting program has been performed, the first entrance address of the system program is calculated；Using the first entrance address as initial address, the system program is run.In multi-thread environment, the present invention can effectively avoid that system program is frequently carried out to hook up operation and go to hook up the abnormal situation of the read-write for operating and bringing, and improve the robustness and security for the technology of hooking up.
Description
Technical field
The present invention relates to function field is hooked up, more particularly to a kind of improved method and device for hooking up technology.
Background technology
The existing technology that hooks up is the content by changing five bytes at the entry address of system program, from
And the entry address of injecting program is jumped to, so as to reach the purpose hooked up.In the entrance of modification system program
, it is necessary to preserve the interior of first five byte of the entry address of system function before the content of five bytes at address
Hold., it is necessary to jump to the entry address of system program after operation completes to hook up function, now it is accomplished by
Recover original system function using the content of first five byte at the entry address of the system function preserved.
But in multi-thread environment, content excessively frequently to first five byte of the entry address of system program
Modify and operate and recovery operation, it is possible to the abnormal situation of read-write can be caused to occur, cause system process
Generation is abnormal.How to solve the above problems, just become industry problem urgently to be resolved hurrily.
The content of the invention
The present invention provides a kind of improved method and device for hooking up technology, to when using technology is hooked up,
Avoid occurring the abnormal situation of read-write.
First aspect according to embodiments of the present invention there is provided a kind of improved method for hooking up technology, including：
When monitoring that system program is hooked up, the system program is changed using entry address as the continuous of starting
Two bytes content；
Content according to the amended system program using entry address as continuous two bytes of starting,
Jump to the entry address of injecting program；
After the injecting program has been performed, the first entrance address of the system program is calculated；
Using the first entrance address as initial address, the system program is run.
This is described when monitoring that system program is hooked up in one embodiment, changes the system program
Using entry address as the content of continuous two bytes of starting, including：
When monitoring that system program is hooked up, the system program is changed using entry address as the continuous of starting
The contents of two bytes be short jump instruction, the short jump instruction redirects key including the short of byte
The short jump address of word and a byte；
The address of the 5th byte before the short jump address sensing system program entry address.
In one embodiment, the company according to the amended system program using entry address as starting
The content of two continuous bytes, jumps to the entry address of injecting program, including：
According to the short jump instruction, the 5th byte jumped to before the system program entry address
Address；
The content of continuous five bytes is jump instruction before changing the system program entry address, described
Jump instruction includes the jump address for redirecting keyword and four bytes of a byte；
According to the jump instruction, the entry address of the injecting program is jumped to.
In one embodiment, it is described after the injecting program has been performed, calculate the system program
First entrance address, including：
After the injecting program has been performed, by the entry address of the system program plus two words
Section, obtains new address；
Confirm the first entrance address that the new address is the system program.
In one embodiment, it is described using the first entrance address as initial address, run the system journey
Sequence, including：
Jump to the first entrance address of the system program；
Using the first entrance address as initial address, the system program is run.
Second aspect according to embodiments of the present invention there is provided a kind of improved device for hooking up technology, including：
Modified module, for when monitoring that system program is hooked up, changes the system program with entrance
Location is the content of continuous two bytes originated；
Jump module, for according to the amended system program using entry address as starting continuous two
The content of individual byte, jumps to the entry address of injecting program；
Computing module, first for after the injecting program has been performed, calculating the system program enters
Port address；
Module is run, for using the first entrance address as initial address, running the system program.
In one embodiment, the modified module, including：
First modification submodule, for when monitoring that system program is hooked up, change the system program with
Entry address is that the content of continuous two bytes of starting is short jump instruction, and the short jump instruction includes
The short short jump address for redirecting keyword and a byte of one byte；
Submodule is pointed to, the 5th before the system program entry address is pointed to for the short jump address
The address of individual byte.
In one embodiment, the jump module, including：
First redirects submodule, for according to the short jump instruction, jumping to the system program entrance
The address of the 5th byte before location；
Second modification submodule, for continuous five bytes before changing the system program entry address
Content is jump instruction, and what the jump instruction included byte redirects redirecting for keyword and four bytes
Address；
Second redirects submodule, for according to the jump instruction, with jumping to the entrance of the injecting program
Location.
In one embodiment, the computing module, including：
Submodule is added, for after the injecting program has been performed, by the entrance of the system program
Address obtains new address plus two bytes；
Submodule is confirmed, for confirming first entrance address of the new address for the system program.
In one embodiment, the operation module, including：
3rd redirects submodule, the first entrance address for jumping to the system program；
Submodule is run, for using the first entrance address as initial address, running the system program.
Other features and advantages of the present invention will be illustrated in the following description, also, partly from explanation
Become apparent, or understood by implementing the present invention in book.The purpose of the present invention and other advantages can
Realize and obtain by specifically noted structure in the specification, claims and accompanying drawing write
.
Below by drawings and examples, technical scheme is described in further detail.
Brief description of the drawings
Accompanying drawing is used for providing a further understanding of the present invention, and constitutes a part for specification, with this hair
Bright embodiment is used to explain the present invention together, is not construed as limiting the invention.In the accompanying drawings：
Fig. 1 is a kind of flow of improved method for hooking up technology shown in an exemplary embodiment of the invention
Figure；
Fig. 2 be an exemplary embodiment of the invention shown in it is a kind of it is improved hook up technology method the step of
S11 flow chart；
Fig. 3 be an exemplary embodiment of the invention shown in it is a kind of it is improved hook up technology method the step of
S12 flow chart；
Fig. 4 be an exemplary embodiment of the invention shown in it is a kind of it is improved hook up technology method the step of
S13 flow chart；
Fig. 5 be an exemplary embodiment of the invention shown in it is a kind of it is improved hook up technology method the step of
S14 flow charts；
Fig. 6 a are a kind of signal of improved method for hooking up technology shown in an exemplary embodiment of the invention
Figure；
Fig. 6 b are a kind of showing for improved method for hooking up technology shown in another exemplary embodiment of the present invention
It is intended to；
Fig. 7 is a kind of block diagram of improved device for hooking up technology shown in an exemplary embodiment of the invention；
Fig. 8 is a kind of modification mould of improved device for hooking up technology shown in an exemplary embodiment of the invention
The block diagram of block 71；
Fig. 9 redirects mould for a kind of improved device for hooking up technology shown in an exemplary embodiment of the invention
The block diagram of block 72；
Figure 10 is a kind of calculating of improved device for hooking up technology shown in an exemplary embodiment of the invention
The block diagram of module 73；
Figure 11 is a kind of modification of improved device for hooking up technology shown in an exemplary embodiment of the invention
The block diagram of module 74.
Embodiment
The preferred embodiments of the present invention are illustrated below in conjunction with accompanying drawing, it will be appreciated that described herein
Preferred embodiment is merely to illustrate and explain the present invention, and is not intended to limit the present invention.
The existing technology that hooks up is the content by changing five bytes at the entry address of system program, is jumped
The entry address of injecting program is gone to, so as to reach the purpose hooked up.In the entry address of modification system program
, it is necessary to preserve the content of first five byte of the entry address of system function before the content of five bytes at place.
, it is necessary to jump to the entry address of system program after operation completes to hook up function, now it is accomplished by utilizing
The content of first five byte at the entry address of the system function preserved recovers original system function.But
In multi-thread environment, the content excessively frequently to first five byte of the entry address of system program is carried out
Modification operation and recovery operation, it is possible to the abnormal situation of read-write can be caused to occur, cause system process
It is abnormal.
Fig. 1 is a kind of improved method flow diagram for hooking up technology according to an exemplary embodiment, such as
Shown in Fig. 1, a kind of improved method for hooking up technology comprises the following steps S11-S14：
In step s 11, when monitoring that system program is hooked up, the system program is changed with entrance
Location is the content of continuous two bytes originated；
When monitoring that system program is hooked up, the system program is changed using entry address as the continuous of starting
The content of two bytes is short jump instruction, the short jump instruction include byte it is short redirect keyword and
The short jump address of one byte；The short jump address points to the 5th before the system program entry address
The address of byte.
In step s 12, according to the amended system program using entry address as continuous the two of starting
The content of individual byte, jumps to the entry address of injecting program；
According to the short jump instruction, the ground of the 5th byte jumped to before the system program entry address
Location；The content of continuous five bytes is jump instruction before changing the system program entry address, and this is redirected
Instruction includes the jump address for redirecting keyword and four bytes of a byte；According to the jump instruction, jump
Go to the entry address of the injecting program.
In step s 13, after the injecting program has been performed, calculate the system program first enters
Port address；
After the injecting program has been performed, by the entry address of the system program plus two bytes, obtain
New address；Confirm the first entrance address that the new address is the system program.
In step S14, using the first entrance address as initial address, the system program is run.
Jump to the first entrance address of the system program；Using the first entrance address as initial address, fortune
The row system program.Can effectively it be avoided in multi-thread environment by aforesaid operations frequent to system program
Progress hook up operation and the abnormal situation of the read-write going to hook up operation and bring, improve the Shandong for the technology of hooking up
Rod and security.
In one embodiment, as shown in Fig. 2 step S11 comprises the following steps S21-S22：
In the step s 21, when monitoring that system program is hooked up, the system program is changed with entrance
Location is that the content of continuous two bytes of starting is short jump instruction, and the short jump instruction includes a word
The short short jump address for redirecting keyword and a byte of section；
The entry address that system program might as well be assumed is X, then to address in two bytes of X and X+1
Content modify.Using the technical scheme in the present embodiment, before modifying, without preserving system
The entry address of program is the content of continuous two bytes originated.It can omit and existing hook up technology
In, the operating procedure of the content of system function the first two byte is preserved, can also save to preserve system journey
Memory space used in the content of sequence the first two byte.
In step S22, the short jump address points to the 5th before the system program entry address
The address of byte.
The entry address that system program might as well be assumed is X, then the address that the short jump address is pointed to is X-5.
In one embodiment, as shown in figure 3, step S12 comprises the following steps S31-S33：
In step S31, according to the short jump instruction, jump to before the system program entry address
The 5th byte address；
The entry address that system program might as well be assumed is X, then according to the short jump instruction, jump to X-5
The address at place, it is the program at X-5 that system, which prepares operation address,.
In step s 32, the content of continuous five bytes is before changing the system program entry address
Jump instruction, the jump instruction includes the jump address for redirecting keyword and four bytes of a byte；
Modified address is that the content at X-5 is jump instruction, and the jump address in challenge instruction is injection letter
Several entry addresses, it is Y that might as well assume the entry address.
In step S33, according to the jump instruction, the entry address of the injecting program is jumped to.
According to the jump instruction, the entry address Y of the injecting program is jumped to, system prepares operation address and is
Program at Y.
In one embodiment, as shown in figure 4, step S13 comprises the following steps S41-S42：
In step S41, after the injecting program has been performed, by the entrance of the system program
Location obtains new address plus two bytes；
The entry address that system program might as well be assumed is X, then new address is X+2.
In step S42, the first entrance address that the new address is the system program is confirmed.
Confirm the first entrance address that new address X+2 is system program.Technology is hooked up existing, is needed
The content of 2 bytes before the unmodified preceding system function preserved is utilized, to recover amended system journey
Sequence.Moreover, in the prior art, the address of rebound is also the entry address of original system program.Use this implementation
Technical scheme in example, can save the behaviour of the entry address of the existing recovery original system program hooked up in technology
Make.The present invention can effectively avoid that system program is frequently carried out to hook up operation and go in multi-thread environment
The situation for the read-write exception for hooking up operation and bringing, improves the robustness and security for the technology of hooking up.
In one embodiment, as shown in figure 5, step S14 comprises the following steps S51-S52：
In step s 51, the first entrance address of the system program is jumped to；
In step S52, using the first entrance address as initial address, the system program is run.
Jump at the X+2 of first entrance address, using at the X+2 of first entrance address as initial address, system
Run the system program at this.
In one embodiment, as shown in figures 6 a and 6b, in one embodiment, the entrance of system function
Address is 77D507EA.Address is that command M OV EDI, the EDI effects at 77D507EA are by EDI
Data in register deliver to EDI, and this instruction takes the content of 2 bytes.Address is 77D507E5
To address be 77D507E9 at 5 line codes be all NOP, the effect of NOP instruction is idle loop one
The time of machine instruction, each NOP instruction takes the space of 1 byte.
Modified address is that MOV EDI, the EDI instructions at 77D507EA are JMP SHORT
USER32.77D507E5, the instruction act as the short address that jumps to at 77D507E5, system after
The continuous address that performs is the code at 77D507E5.Address is that the code at 77D507E5 is JMP
The acting as of RPCRT4.77E507EA, this instruction JMP RPCRT4.77E507EA jumps to note
Enter the entry address of function.
After injection function has been run, jump at the 77D507EC of address, 77D507EC=77D507EA
+ 2, that is, the entry address 77D507EA for jumping to system function adds the address that 2 bytes go out
77D507EC, using at the 77D507EC of address as initial address, runs the system function.
In one embodiment, Fig. 7 is that a kind of according to an exemplary embodiment improved hooks up technology
Device block diagram.As Fig. 7 shows, the device includes modified module 71, jump module 72, computing module 73
With operation module 74.
The modified module 71, for when monitoring that system program is hooked up, changing the system program to enter
Port address is the content of continuous two bytes originated；
The jump module 72, for continuous using entry address as what is originated according to the amended system program
Two bytes content, jump to the entry address of injecting program；
The computing module 73, for after the injecting program has been performed, calculating the system program
One entry address；
The operation module 74, for using the first entrance address as initial address, running the system program.
As shown in figure 8, the modified module 71 includes the first modification submodule 81 and points to submodule 82.
The first modification submodule 81, for when monitoring that system program is hooked up, changing the system journey
Sequence is short jump instruction by the content of continuous two bytes of starting of entry address, the short jump instruction
Include the short short jump address for redirecting keyword and a byte of a byte；
The sensing submodule 82, before the short jump address sensing system program entry address
The address of 5th byte.
As shown in figure 9, the jump module 72 redirects the modification submodule 92 of submodule 91, second including first
Submodule 93 is redirected with second.
This first redirects submodule 91, for according to the short jump instruction, jumping to the system program and entering
The address of the 5th byte before port address；
The second modification submodule 92, for continuous five words before changing the system program entry address
The content of section is jump instruction, and what the jump instruction included byte redirects keyword and four bytes
Jump address；
This second redirects submodule 93, for according to the jump instruction, jumping to entering for the injecting program
Port address.
As shown in Figure 10, the computing module 73 includes being added submodule 101 and confirms submodule 102：
The addition submodule 101, for after the injecting program has been performed, by the institute of the system program
Entry address is stated plus two bytes, new address is obtained；
The confirmation submodule 102, for confirming first entrance that the new address is the system program
Location.
As shown in figure 11, the operation module 74 redirects submodule 111 and operation submodule 112 including the 3rd.
3rd redirects submodule 111, the first entrance address for jumping to the system program；
The operation submodule 112, for using the first entrance address as initial address, running the system
Program.
It should be understood by those skilled in the art that, embodiments of the invention can be provided as method, system or meter
Calculation machine program product.Therefore, the present invention can be using complete hardware embodiment, complete software embodiment or knot
The form of embodiment in terms of conjunction software and hardware.Wherein wrapped one or more moreover, the present invention can be used
Containing computer usable program code computer-usable storage medium (include but is not limited to magnetic disk storage and
Optical memory etc.) on the form of computer program product implemented.
The present invention is with reference to the production of method according to embodiments of the present invention, equipment (system) and computer program
The flow chart and/or block diagram of product is described.It should be understood that can by computer program instructions implementation process figure and
/ or each flow and/or square frame in block diagram and the flow in flow chart and/or block diagram and/
Or the combination of square frame.These computer program instructions can be provided to all-purpose computer, special-purpose computer, insertion
Formula processor or the processor of other programmable data processing devices are to produce a machine so that pass through and calculate
The instruction of the computing device of machine or other programmable data processing devices is produced for realizing in flow chart one
The device for the function of being specified in individual flow or multiple flows and/or one square frame of block diagram or multiple square frames.
These computer program instructions, which may be alternatively stored in, can guide computer or the processing of other programmable datas to set
In the standby computer-readable memory worked in a specific way so that be stored in the computer-readable memory
Instruction produce include the manufacture of command device, the command device realization in one flow or multiple of flow chart
The function of being specified in one square frame of flow and/or block diagram or multiple square frames.
These computer program instructions can be also loaded into computer or other programmable data processing devices, made
Obtain and perform series of operation steps on computer or other programmable devices to produce computer implemented place
Reason, so that the instruction performed on computer or other programmable devices is provided for realizing in flow chart one
The step of function of being specified in flow or multiple flows and/or one square frame of block diagram or multiple square frames.
Obviously, those skilled in the art can carry out various changes and modification without departing from this to the present invention
The spirit and scope of invention.So, if these modifications and variations of the present invention belong to the claims in the present invention
And its within the scope of equivalent technologies, then the present invention is also intended to comprising including these changes and modification.
Claims (10)
1. a kind of improved method for hooking up technology, it is characterised in that including：
When monitoring that system program is hooked up, the system program is changed using entry address as the continuous of starting
Two bytes content；
Content according to the amended system program using entry address as continuous two bytes of starting,
Jump to the entry address of injecting program；
After the injecting program has been performed, the first entrance address of the system program is calculated；
Using the first entrance address as initial address, the system program is run.
2. the method as described in claim 1, it is characterised in that described to monitor that system program is hooked
When taking, content of the system program using entry address as continuous two bytes of starting is changed, including：
When monitoring that system program is hooked up, the system program is changed using entry address as the continuous of starting
The contents of two bytes be short jump instruction, the short jump instruction redirects key including the short of byte
The short jump address of word and a byte；
The address of the 5th byte before the short jump address sensing system program entry address.
3. method as claimed in claim 2, it is characterised in that described according to the amended system
Content of the program using entry address as continuous two bytes of starting, with jumping to the entrance of injecting program
Location, including：
According to the short jump instruction, the 5th byte jumped to before the system program entry address
Address；
The content of continuous five bytes is jump instruction before changing the system program entry address, described
Jump instruction includes the jump address for redirecting keyword and four bytes of a byte；
According to the jump instruction, the entry address of the injecting program is jumped to.
4. the method as described in claim 1, it is characterised in that described to perform the injecting program
Afterwards, the first entrance address of the system program is calculated, including：
After the injecting program has been performed, by the entry address of the system program plus two words
Section, obtains new address；
Confirm the first entrance address that the new address is the system program.
5. method as claimed in claim 4, it is characterised in that it is described using the first entrance address as
Initial address, runs the system program, including：
Jump to the first entrance address of the system program；
Using the first entrance address as initial address, the system program is run.
6. a kind of improved device for hooking up technology, it is characterised in that including：
Modified module, for when monitoring that system program is hooked up, changes the system program with entrance
Location is the content of continuous two bytes originated；
Jump module, for according to the amended system program using entry address as starting continuous two
The content of individual byte, jumps to the entry address of injecting program；
Computing module, first for after the injecting program has been performed, calculating the system program enters
Port address；
Module is run, for using the first entrance address as initial address, running the system program.
7. device according to claim 6, it is characterised in that the modified module, including：
First modification submodule, for when monitoring that system program is hooked up, change the system program with
Entry address is that the content of continuous two bytes of starting is short jump instruction, and the short jump instruction includes
The short short jump address for redirecting keyword and a byte of one byte；
Submodule is pointed to, the 5th before the system program entry address is pointed to for the short jump address
The address of individual byte.
8. device according to claim 7, it is characterised in that the jump module, including：
First redirects submodule, for according to the short jump instruction, jumping to the system program entrance
The address of the 5th byte before location；
Second modification submodule, for continuous five bytes before changing the system program entry address
Content is jump instruction, and what the jump instruction included byte redirects redirecting for keyword and four bytes
Address；
Second redirects submodule, for according to the jump instruction, with jumping to the entrance of the injecting program
Location.
9. device according to claim 6, it is characterised in that the computing module, including：
Submodule is added, for after the injecting program has been performed, by the entrance of the system program
Address obtains new address plus two bytes；
Submodule is confirmed, for confirming first entrance address of the new address for the system program.
10. device according to claim 9, it is characterised in that the operation module, including：
3rd redirects submodule, the first entrance address for jumping to the system program；
Submodule is run, for using the first entrance address as initial address, running the system program.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610143092.8A CN107193538A (en) | 2016-03-14 | 2016-03-14 | A kind of improved method and device for hooking up technology |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610143092.8A CN107193538A (en) | 2016-03-14 | 2016-03-14 | A kind of improved method and device for hooking up technology |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN107193538A true CN107193538A (en) | 2017-09-22 |
Family
ID=59871975
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610143092.8A Pending CN107193538A (en) | 2016-03-14 | 2016-03-14 | A kind of improved method and device for hooking up technology |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107193538A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107943517A (en) * | 2017-10-26 | 2018-04-20 | 北京奇虎科技有限公司 | The hook method and device of terminal applies |
| CN109766145A (en) * | 2019-01-22 | 2019-05-17 | 杭州云缔盟科技有限公司 | A kind of method that function hot patch is realized by HOOK technology under Windows |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP0263447A2 (en) * | 1986-10-10 | 1988-04-13 | International Business Machines Corporation | A method and apparatus for implementing a branch and return on address instruction in a digital data processing system |
| CN101719077A (en) * | 2009-12-24 | 2010-06-02 | 北京飞天诚信科技有限公司 | Method and device for injecting codes in .Net program |
| CN103218262A (en) * | 2010-02-11 | 2013-07-24 | 华为技术有限公司 | Activation method, activation device and activation system of online patches |
| CN103530184A (en) * | 2013-10-24 | 2014-01-22 | 华为技术有限公司 | Method and device for online patch activation |
-
2016
- 2016-03-14 CN CN201610143092.8A patent/CN107193538A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| EP0263447A2 (en) * | 1986-10-10 | 1988-04-13 | International Business Machines Corporation | A method and apparatus for implementing a branch and return on address instruction in a digital data processing system |
| CN101719077A (en) * | 2009-12-24 | 2010-06-02 | 北京飞天诚信科技有限公司 | Method and device for injecting codes in .Net program |
| CN103218262A (en) * | 2010-02-11 | 2013-07-24 | 华为技术有限公司 | Activation method, activation device and activation system of online patches |
| CN103530184A (en) * | 2013-10-24 | 2014-01-22 | 华为技术有限公司 | Method and device for online patch activation |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107943517A (en) * | 2017-10-26 | 2018-04-20 | 北京奇虎科技有限公司 | The hook method and device of terminal applies |
| CN109766145A (en) * | 2019-01-22 | 2019-05-17 | 杭州云缔盟科技有限公司 | A kind of method that function hot patch is realized by HOOK technology under Windows |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| JP5602597B2 (en) | Method, computer program, and system for memory optimization of virtual machine code by segmenting foreign information | |
| US10007784B2 (en) | Technologies for control flow exploit mitigation using processor trace | |
| CN107480476B (en) | Android native layer instruction compiling virtualization shell adding method based on ELF infection | |
| CN110825363B (en) | Intelligent contract acquisition method and device, electronic equipment and storage medium | |
| CN103946855A (en) | Methods, devices, and systems for detecting return-oriented programming exploits | |
| Kalysch et al. | VMAttack: Deobfuscating virtualization-based packed binaries | |
| CN107608750A (en) | Counter operation in state machine lattice | |
| CN104918119B (en) | Method for processing video frequency based on iOS browsers and video process apparatus | |
| CN107545182B (en) | Around the method and system of function call chain detection in a kind of IOS application | |
| CN104536810B (en) | A kind of method for detecting abnormality and device based on stack | |
| JP2022009556A (en) | Method for securing software codes | |
| CN105468588A (en) | Character string matching method and apparatus | |
| CN107239698A (en) | A kind of anti-debug method and apparatus based on signal transacting mechanism | |
| CN108319850A (en) | Method, sandbox system and the sandbox equipment of sandbox detection | |
| CN104252594A (en) | Virus detection method and device | |
| CN107193538A (en) | A kind of improved method and device for hooking up technology | |
| CN106709335B (en) | Vulnerability detection method and device | |
| CN104298618B (en) | The command handling method and device of a kind of intelligent terminal | |
| CN107943517A (en) | The hook method and device of terminal applies | |
| CN107436752A (en) | Abnormal in-situ FTIR spectroelectrochemitry method, apparatus and computer-readable recording medium | |
| CN110673899B (en) | Program processing method and related equipment | |
| CN112631949B (en) | Debugging method and device, computer equipment and storage medium | |
| JP5024252B2 (en) | Trace information acquisition device, trace information acquisition program, and trace information acquisition method | |
| CN107045606B (en) | Method and apparatus for monitoring execution of program code | |
| CN111488558B (en) | Script protection method and device, computer readable storage medium and computer equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170922 |
|
| RJ01 | Rejection of invention patent application after publication |