Patent ID: 9600665
Date: 2017-03-21
CPC Classifications: G06F

Claim:
1. A monitoring device, comprising: circuitry configured to: determine whether or not a program to be executed is a program to be monitored; when the circuitry determines the program as the program to be monitored, the circuitry is further configured to dynamically generate a first instruction string satisfying a condition of executing a condition branch instruction each time a dynamic link library (DLL) implemented with an application program interface (API) to be hooked is loaded into a memory, the API being called by the program to be monitored, wherein the condition branch instruction is an instruction starting a process for monitoring behavior of the program to be monitored; add the first instruction string and the condition branch instruction in order, followed by an instruction string included in the API to be hooked; disable the program's ability to recognize that the program being monitored; and monitor the program being executed without the monitoring being obstructed.