KR101242127B1 - Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법 - Google Patents

Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법 Download PDF

Info

Publication number
KR101242127B1
KR101242127B1 KR1020110039901A KR20110039901A KR101242127B1 KR 101242127 B1 KR101242127 B1 KR 101242127B1 KR 1020110039901 A KR1020110039901 A KR 1020110039901A KR 20110039901 A KR20110039901 A KR 20110039901A KR 101242127 B1 KR101242127 B1 KR 101242127B1
Authority
KR
South Korea
Prior art keywords
target process
dll
injection
target
program
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
KR1020110039901A
Other languages
English (en)
Korean (ko)
Other versions
KR20120121973A (ko
Inventor
이종일
이남수
Original Assignee
주식회사 파수닷컴
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 주식회사 파수닷컴 filed Critical 주식회사 파수닷컴
Priority to KR1020110039901A priority Critical patent/KR101242127B1/ko
Priority to JP2014508278A priority patent/JP2014518582A/ja
Priority to US14/113,249 priority patent/US8875165B2/en
Priority to PCT/KR2012/001775 priority patent/WO2012148080A2/ko
Priority to EP12777809.0A priority patent/EP2704004B1/en
Publication of KR20120121973A publication Critical patent/KR20120121973A/ko
Application granted granted Critical
Publication of KR101242127B1 publication Critical patent/KR101242127B1/ko
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44521—Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/451—Execution arrangements for user interfaces

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Mathematical Physics (AREA)
  • Human Computer Interaction (AREA)
  • Stored Programmes (AREA)
KR1020110039901A 2011-04-28 2011-04-28 Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법 Active KR101242127B1 (ko)

Priority Applications (5)

Application Number Priority Date Filing Date Title
KR1020110039901A KR101242127B1 (ko) 2011-04-28 2011-04-28 Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법
JP2014508278A JP2014518582A (ja) 2011-04-28 2012-03-12 Ｄｌｌインジェクション機能を持つコンピュータ装置及びｄｌｌインジェクション方法
US14/113,249 US8875165B2 (en) 2011-04-28 2012-03-12 Computing device having a DLL injection function, and DLL injection method
PCT/KR2012/001775 WO2012148080A2 (ko) 2011-04-28 2012-03-12 Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법
EP12777809.0A EP2704004B1 (en) 2011-04-28 2012-03-12 Computing device having a dll injection function, and dll injection method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
KR1020110039901A KR101242127B1 (ko) 2011-04-28 2011-04-28 Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법

Publications (2)

Publication Number Publication Date
KR20120121973A KR20120121973A (ko) 2012-11-07
KR101242127B1 true KR101242127B1 (ko) 2013-03-12

Family

ID=47072842

Family Applications (1)

Application Number Title Priority Date Filing Date
KR1020110039901A Active KR101242127B1 (ko) 2011-04-28 2011-04-28 Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법

Country Status (5)

Country Link
US (1) US8875165B2 (https=)
EP (1) EP2704004B1 (https=)
JP (1) JP2014518582A (https=)
KR (1) KR101242127B1 (https=)
WO (1) WO2012148080A2 (https=)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20200054752A (ko) 2018-11-12 2020-05-20 주식회사 안랩 메시지 모니터링 장치 및 방법

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105809026B (zh) * 2014-12-29 2019-02-01 北京奇虎科技有限公司 进程的权限配置方法及装置
US10083296B2 (en) * 2015-06-27 2018-09-25 Mcafee, Llc Detection of malicious thread suspension
CN106095482A (zh) * 2016-05-31 2016-11-09 宇龙计算机通信科技(深圳)有限公司 应用程序的冻结方法及装置
US10235161B2 (en) * 2017-02-06 2019-03-19 American Megatrends, Inc. Techniques of adding security patches to embedded systems
JP6957311B2 (ja) * 2017-10-25 2021-11-02 システムインテリジェント株式会社 情報漏洩防止装置、及び情報漏洩防止プログラム
US10747874B2 (en) * 2018-05-22 2020-08-18 NortonLifeLock, Inc. Systems and methods for controlling an application launch based on a security policy
CN111198723B (zh) * 2018-11-19 2023-03-07 深圳市优必选科技有限公司 一种进程注入方法、终端设备及计算机可读存储介质
KR101958933B1 (ko) * 2018-12-18 2019-03-18 주식회사 웨어밸리 소켓 인젝션을 통한 데이터베이스 내의 정보 수집 방법 및 장치
US11170126B2 (en) 2019-01-03 2021-11-09 Citrix Systems, Inc. Policy based notification protection service in workspace
US11307910B2 (en) * 2019-06-10 2022-04-19 Citrix Systems, Inc. Notification tagging for a workspace or application
CN111338922B (zh) * 2020-03-02 2023-04-11 武汉思普崚技术有限公司 Dll失效的检测方法及装置
CN111475229B (zh) * 2020-04-09 2021-01-15 广州锦行网络科技有限公司 一种Windows平台下的dll注入方法及系统
US11681520B2 (en) 2021-04-20 2023-06-20 International Business Machines Corporation Software upgrading using dynamic link library injection
CN116932046B (zh) * 2022-04-12 2026-04-21 数篷信息技术(深圳)有限公司 进程入口的内核注入方法、代码执行方法、系统及设备

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6141698A (en) * 1997-01-29 2000-10-31 Network Commerce Inc. Method and system for injecting new code into existing application code
JP2011013955A (ja) * 2009-07-02 2011-01-20 Hitachi Systems & Services Ltd メディアチェック回避システム

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7039919B1 (en) * 1998-10-02 2006-05-02 Microsoft Corporation Tools and techniques for instrumenting interfaces of units of a software program
US6463583B1 (en) 1999-04-08 2002-10-08 Novadigm, Inc. Dynamic injection of execution logic into main dynamic link library function of the original kernel of a windowed operating system
US8769268B2 (en) * 2007-07-20 2014-07-01 Check Point Software Technologies, Inc. System and methods providing secure workspace sessions
US8578483B2 (en) * 2008-07-31 2013-11-05 Carnegie Mellon University Systems and methods for preventing unauthorized modification of an operating system
US20120167057A1 (en) * 2010-12-22 2012-06-28 Microsoft Corporation Dynamic instrumentation of software code

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6141698A (en) * 1997-01-29 2000-10-31 Network Commerce Inc. Method and system for injecting new code into existing application code
JP2011013955A (ja) * 2009-07-02 2011-01-20 Hitachi Systems & Services Ltd メディアチェック回避システム

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20200054752A (ko) 2018-11-12 2020-05-20 주식회사 안랩 메시지 모니터링 장치 및 방법

Also Published As

Publication number Publication date
WO2012148080A2 (ko) 2012-11-01
EP2704004A4 (en) 2014-12-17
JP2014518582A (ja) 2014-07-31
US20140047461A1 (en) 2014-02-13
EP2704004A2 (en) 2014-03-05
US8875165B2 (en) 2014-10-28
EP2704004B1 (en) 2016-02-03
KR20120121973A (ko) 2012-11-07
WO2012148080A3 (ko) 2013-01-03

Similar Documents

Publication Publication Date Title
KR101242127B1 (ko) Ｄｌｌ 인젝션 기능을 구비한 컴퓨팅 장치 및 ｄｌｌ 인젝션 방법
KR101740224B1 (ko) 불법 모드 변경처리
JP6842367B2 (ja) ファイル中の悪意のあるコードの検出システム及び方法
CN102799817B (zh) 用于使用虚拟化技术进行恶意软件保护的系统和方法
KR102189296B1 (ko) 가상 머신 보안 어플리케이션을 위한 이벤트 필터링
JP5607752B2 (ja) 不正な変更からオペレーティング・システムを保護するための方法及びシステム
JP2010517164A (ja) オペレーティングシステム資源の保護
JP2014518582A5 (https=)
US9111096B2 (en) System and method for preserving and subsequently restoring emulator state
US11263065B2 (en) Method for identifying at least one function of an operating system kernel
CN107209815B (zh) 用于使用返回导向编程的代码混淆的方法
KR101207434B1 (ko) 이종의 디지털 문서 보호 시스템 간의 충돌 방지 시스템 및 방법
RU2592383C1 (ru) Способ формирования антивирусной записи при обнаружении вредоносного кода в оперативной памяти
Berkowitz et al. A static over-approximate detection tool for at-risk dlls
KR20180093529A (ko) 바이트코드와 네이티브코드 간의 상호 의존성에 기반한 어플리케이션 위변조 방지 방법 및 장치
WO2022031275A1 (en) Detection of memory modification
KR101653741B1 (ko) 실행 프로그램 동작 감시방법, 감시장치 및 이를 위한 컴퓨터 프로그램, 그 기록매체
CN116775147B (zh) 一种可执行文件处理方法、装置、设备及存储介质
KR20210107386A (ko) 전자 장치 및 그 제어 방법
US12578938B2 (en) Exploit prevention based on generation of random chaotic execution context
Ciholas et al. Fast and furious: outrunning Windows kernel notification routines from user-mode
Pearce Windows Internals and Malware Behavior: Malware Analysis Day 3 [Slides]
RU2606883C2 (ru) Система и способ открытия файлов, созданных уязвимыми приложениями
Saxena et al. Effective Containment of Shared-Memory Application Extensions
CN115270117A (zh) 依于子程序执行的应用程序控管方法

Legal Events

Date Code Title Description
A201 Request for examination
PA0109 Patent application

Patent event code: PA01091R01D

Comment text: Patent Application

Patent event date: 20110428

PA0201 Request for examination
E902 Notification of reason for refusal
PE0902 Notice of grounds for rejection

Comment text: Notification of reason for refusal

Patent event date: 20120926

Patent event code: PE09021S01D

PG1501 Laying open of application
E701 Decision to grant or registration of patent right
PE0701 Decision of registration

Patent event code: PE07011S01D

Comment text: Decision to Grant Registration

Patent event date: 20130226

GRNT Written decision to grant
PR0701 Registration of establishment

Comment text: Registration of Establishment

Patent event date: 20130305

Patent event code: PR07011E01D

PR1002 Payment of registration fee

Payment date: 20130306

End annual number: 3

Start annual number: 1

PG1601 Publication of registration
FPAY Annual fee payment

Payment date: 20160225

Year of fee payment: 6

PR1001 Payment of annual fee

Payment date: 20160225

Start annual number: 4

End annual number: 6

FPAY Annual fee payment

Payment date: 20190225

Year of fee payment: 7

PR1001 Payment of annual fee

Payment date: 20190225

Start annual number: 7

End annual number: 7

FPAY Annual fee payment

Payment date: 20200305

Year of fee payment: 8

PR1001 Payment of annual fee

Payment date: 20200305

Start annual number: 8

End annual number: 8

FPAY Annual fee payment

Payment date: 20210219

Year of fee payment: 9

PR1001 Payment of annual fee

Payment date: 20210219

Start annual number: 9

End annual number: 9

FPAY Annual fee payment

Payment date: 20220302

Year of fee payment: 10

PR1001 Payment of annual fee

Payment date: 20220302

Start annual number: 10

End annual number: 10

PR1001 Payment of annual fee

Payment date: 20240228

Start annual number: 12

End annual number: 12

PR1001 Payment of annual fee

Payment date: 20241205

Start annual number: 13

End annual number: 13