Application module injection device, computing device including application module injection function, and recording medium for recording program for executing application module injection method

摘要

Provided are an application module injection device, a computing device including an application module injection function, and a recording medium that records a program for executing an application module injection method. The application module injection device includes a function registration unit configured to register, in an operating system (OS), a first callback function for receiving a notice about whether a process corresponding to a program whose execution is instructed by a user is created from the OS and a second callback function for receiving a notice about whether an image corresponding to the program whose execution is instructed by the user is driven, a process information acquisition unit configured to receive the notice about whether the process corresponding to the program whose execution is instructed by the user is created from the OS through the first callback function, a process determination unit configured to select a process generated so as to correspond to the program whose execution is instructed by the user as an application module injection target process when the program whose execution is instructed by the user, which is determined through the second callback function, corresponds to a predetermined type of program, a context change unit configured to change a first entry point included in a context of a thread corresponding to the application module injection target process into a second entry point of an injected application module, and an application module injection unit configured to inject the application module into the application module injection target process.

主权项

1. A computing device comprising:
a processor configured to execute an OS and an injection module; and a memory configured to store the OS and the injection module, wherein the injection module includes a function registration module configured to register, in the OS, a first callback function for receiving a notice about whether a process corresponding to a program whose execution is instructed by a user is created from the OS and a second callback function for receiving a notice about whether an image corresponding to the program whose execution is instructed by the user is driven, a process information acquisition module configured to receive the notice about whether the process corresponding to the program whose execution is instructed by the user is created from the OS through the first callback function; a process determination module configured to select a process generated so as to correspond to the program whose execution is instructed by the user as an application module injection target process when the program whose execution is instructed by the user, which is determined through the second callback function, corresponds to a predetermined type of program; a context change module configured to change a first entry point included in a context of a thread corresponding to the application module injection target process into a second entry point of an injected application module, and an application module injection module configured to inject the application module into the application module injection target process, wherein the injection module is operated in a kernel mode, wherein the process determination module selects the process whose creation has been informed from the OS as the application module injection target process, when the process is not included in a list of processes whose injection is completed.