基于动态追踪技术侦测API钩挂

Detecting API hook based on active trace

作为构筑各类应用基础的API函数的执行通常要历经用户状态和核心状态的多个模块,环节众多,很容易受到不安全模块的HOOK攻击,严重威胁整个系统的安全。针对此问题,提出了动态跟踪API函数执行流程,并结合搜索到的模块信息,确定执行流程中是否存在钩挂模块的方法。系统测试结果表明,该方法能够有效地追踪到从发起函数调用到内核系统服务调用所经历的模块信息,为确保API函数的安全运行奠定了良好的基础。

In Windows,an API function＇s executing always goes through two modes（user mode and kernel mode） and many different modules.In this procession,it is often easily attacked by unsafe hook module.Since API function is basement of constructing all kinds of application,this situation make system running the API function very danger.For this,an effective way is proposed to active trace the whole execution flow when a given API function was being called,and then with the help of module information scanned directly in the memory,locate the hook module.Based on the XP system,this way can effectively list all the related modules and lay a good foundation for executing API safely.