一种进程通信劫持技术的实现与应用研究

An Inter-process Communication Hijacking Scheme and Its Application

本文提出一种进程通信劫持技术,无须改动目标进程的源代码,无须重新编译与连接,可任意劫持动态运行中的目标进程通信信道.这种劫持技术不必更改操作系统内核,不用利用操作系统的潜在安全漏洞,完整实现于用户进程空间.该技术在软件动态更新,系统安全监控及动态软件分析方面具有广阔的应用前景.

We redirect, and propose in this paper an inter-process communication hijacking scheme to intercept, filter, modify virtually all commonly used inter-process communication mechanisms in running processes, without requiring recompilation, re-linkage and access to the source codes. Its implementation is orchestrated completely in the user space without kernel modifications and exploitation of potential security vulnerabilities. The hijack scheme demonstrates huge potentials when applied to software dynamic upgrades, system security monitoring and auditing, and software analyses.