Patent ID: 9098701
Filing Date: 2015-08-04
Classification: G06F

Abstract:
1. A computing device comprising: a processor configured to execute an OS and an injection module; and a memory configured to store the OS and the injection module, wherein the injection module includes a function registration module configured to register, in the OS, a first callback function for receiving a notice about whether a process corresponding to a program whose execution is instructed by a user is created from the OS and a second callback function for receiving a notice about whether an image corresponding to the program whose execution is instructed by the user is driven, a process information acquisition module configured to receive the notice about whether the process corresponding to the program whose execution is instructed by the user is created from the OS through the first callback function; a process determination module configured to select a process generated so as to correspond to the program whose execution is instructed by the user as an application module injection target process when the program whose execution is instructed by the user, which is determined through the second callback function, corresponds to a predetermined type of program; a context change module configured to change a first entry point included in a context of a thread corresponding to the application module injection target process into a second entry point of an injected application module, and an application module injection module configured to inject the application module into the application module injection target process, wherein the injection module is operated in a kernel mode, wherein the process determination module selects the process whose creation has been informed from the OS as the application module injection target process, when the process is not included in a list of processes whose injection is completed.