Patent Publication Number: US-8997074-B1

Title: Dynamic linking library (DLL) replacement in an embedded operating system environment

Description:
BACKGROUND OF THE INVENTION 
     Software applications are typically executed using an operating system of a computer system. As is well known, the WINDOWS-based operating system by Microsoft Corporation of Redmond, Wash. enjoys a large installed base. As a consequence, software makers strive to create software applications that can be executed by the WINDOWS-based operating system so that the software application may enjoy the greatest possible market share. 
     In most cases, the installation and execution of a software application (such as for example an anti-virus program) may require the loading of a hook DLL (Dynamic Link Library) to replace the existing DLL managed by the WINDOWS-based operating system. In a WINDOWS-based operating system known as the WINDOWS CE operating system, the installation of a given software application may require the loading of a hook DLL to replace an existing target DLL. After the hook DLL is loaded, the hook DLL handles all subsequent calls made by the newly installed application as well as all subsequent calls that are made by existing applications to the now-replaced target DLL. That is, the target DLL that has been replaced does not get called directly by any other application programs. Instead, the target DLL is called only by the replacement hook DLL. 
     In the WINDOWS CE operating system environment, DLL replacement requires two necessary conditions: 1) that the target DLL be replaced by a replacement DLL during execution, and 2) that the target DLL not be directly called by any application after the hook DLL is loaded except to the extent that calls are made from the hook DLL to the target DLL. 
     In the WINDOWS CE operating system environment, system DLLs are in ROM (Read-Only Memory). Although ROM DLLs can not be overwritten, a RAM DLL can still replace, practically speaking, the corresponding target DLL in ROM if the RAM DLL shares the same name as the ROM DLL. That is, when loading a DLL, the WINDOWS CE operating system environment only examines the DLL file name and ignores the path string in deciding whether a given DLL has already been loaded. If a DLL has been loaded (whether from RAM or ROM), other DLLs having the same name will not be loaded. 
     Accordingly, while it is possible to replace an existing ROM DLL with a RAM DLL (by loading the RAM DLL first), this approach creates another problem since DLL replacement also requires that the ROM-based DLL be loadable so that it can be called on by the replacement RAM DLL. This requirement is illustrated in  FIG. 1  wherein a hook DLL  102 , which is loaded to replace an existing target DLL  104 , makes calls to target DLL  104  (the original ROM-based DLL) while all other applications are prohibited from making direct calls to target DLL  104 . In other words, after the RAM-based DLL  102  is loaded to facilitate the execution of application  106 , application  106  can indirectly make calls to target ROM-based DLL  104  only by making calls to replacement RAM-based DLL  102  first. Likewise, applications  108  and  112  can indirectly make calls to target ROM-based DLL  104  only by making calls to replacement RAM-based DLL  102 . 
     If ROM-based DLL  104  cannot be loaded so that it can be called by replacement RAM-based DLL  102 , the second condition for DLL replacement (i.e., that the target DLL not be directly called after the hook DLL is loaded except to the extent that calls are made from the hook DLL to the target DLL) cannot be met. As such, DLL replacement would fail in the WINDOWS CE operating system environment. 
     SUMMARY OF INVENTION 
     The invention relates, in an embodiment, to a method tor replacing a DLL (Dynamic Link Library) in a Windows CE operating system environment. The method includes loading a first one of a hook DLL and a target DLL representing a DLL to be replaced, the hook DLL representing a DLL for replacing the target DLL. If the hook DLL is loaded first, the method includes changing a name of the hook DLL to a first temporary name, thereafter loading the target DLL, thereafter changing a name of the target DLL to a private name that is subsequently callable by the hook DLL but not callable by other applications executing the Windows CE operating system environment, and thereafter restoring the name of the hook DLL from the first temporary name to a name that is callable by the other applications. The method further includes changing, if the target DLL is loaded first, the name of the target DLL to the private name, and thereafter loading the hook DLL. 
     These and other features of the present invention will be described in more detail below in the detailed description of the invention and in conjunction with the following figures. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which: 
         FIG. 1  shows an example environment wherein DLL replacement is practiced. 
         FIG. 2  shows, in accordance with an embodiment of the present invention, a flowchart implementing the DLL replacement technique for the WINDOWS CE operating system platform. 
         FIG. 3  shows, in accordance with an embodiment of the present invention, a code section for implementing DLL replacement by replacing the ROM-based target DLL with a RAM hook DLL in the WINDOWS CE operating system environment.. 
         FIG. 4  shows, in accordance with an embodiment of the present invention, a method for replacing a ROM-based target DLL in the WINDOWS CE operating system environment. 
         FIG. 5  shows an example environment wherein DLL replacement is practiced in accordance with one or more embodiments of the invention. 
     
    
    
     DETAILED DESCRIPTION OF EMBODIMENTS 
     The present invention will now be described in detail with reference to a few embodiments thereof as illustrated in the accompanying drawings. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without some or all of these specific details. In other instances, well known process steps and/or structures have not been described in detail in order to not unnecessarily obscure the present invention. 
     Various embodiments are described herein below, including methods and techniques. It should be kept in mind that the invention might also cover articles of manufacture that includes a computer readable medium on which computer-readable instructions for carrying out embodiments of the inventive technique are stored. The computer readable medium may include, for example, semiconductor, magnetic, opto-magnetic, optical, or other forms of computer readable medium for storing computer readable code. Further, the invention may also cover apparatuses for practicing embodiments of the invention. Such apparatus may include circuits, dedicated and/or programmable, to carry out tasks pertaining to embodiments of the invention. Examples of such apparatus include a general-purpose computer and/or a dedicated computing device when appropriately programmed and may include a combination of a computer/computing device and dedicated/programmable circuits adapted for the various tasks pertaining to embodiments of the invention. 
     In accordance with embodiments of the present invention, there are provided computer-implemented methods for replacing DLLs in a WINDOWS CE operating system environment such that the target DLL is replaceable by the hook DLL, and the target DLL is callable by the hook DLL but not callable directly by any other applications after the loading of the hook DLL. 
     Recalling that if the hook DLL is loaded first before the target DLL is loaded, and both DLLs share the same file name, the WINDOWS CE operating system inhibits the target DLL from being subsequently loaded. This is true even if the two DLLs have different path names. Accordingly, the target DLL cannot be made available to be called by the hook DLL. 
     In embodiments of the invention, the aforementioned problem is solved by using a trusted application, e.g., trusted application  502  illustrated in the example of  FIG. 5 , to manipulate DLL file names so that both the hook DLL and the target DLL can be loaded. An application is deemed trusted if it is allowed to run in the full kernel mode in a WINDOWS operating system. In this full kernel mode, the trusted application can access the list of loaded DLL modules, e.g., loaded DLL module list  540  illustrated in the example of  FIG. 5 , and therefore has the ability to manipulate the file names of the DLLs to accomplish the dual loading of both the hook DLL and the target DLL. 
     After the hook DLL and the target DLL are loaded, the names of the DLLs are again manipulated such that the hook DLL will end up with the right name whereby the target DLL assumes a name, which may be randomly chosen, that is known only to the hook DLL. As such, the target DLL is callable only by the hook DLL and is not directly callable by any other applications. Further, since the hook DLL now has the correct name, it can be called by applications executing in the computer system. 
     In embodiments of the invention, successful DLL replacement is achieved irrespective whether the target DLL or the hook DLL is loaded first. In an embodiment, if the target DLL is loaded first, the target DLL name is changed by the trusted application after the target DLL is loaded, thus allowing a similarly named hook DLL to be subsequently loaded. The name of the target DLL is preferably changed to a name that is known only by the hook DLL so that only the hook DLL can directly call the target DLL. 
     In another embodiment, if the hook DLL is loaded first, the hook DLL name is changed to another file name to allow the target DLL to be subsequently loaded. After the target DLL is loaded, the name of the target DLL is changed to a name that is known only to the hook DLL. Thereafter, the hook DLL name is restored, allowing the hook DLL to be called by applications executing in the computer system. Further, since the name of the target DLL is changed to a name that is known only by the hook DLL, only the hook DLL can directly call the target DLL. 
     The features and advantages of the present invention may be better understood with reference to the figures and discussions that follow.  FIG. 2  shows, in accordance with an embodiment of the present invention, a flowchart implementing the DLL replacement technique for the WINDOWS CE operating system platform. The steps of  FIG. 2  are preferably performed by a trusted application, i.e., one that runs in the full kernel mode under the WINDOWS CE operating system platform or a platform having a similar requirements for DLL replacement. 
     In step  202 , the method ascertains whether the target DLL has been loaded by ascertaining the list of loaded DLLs. If the target DLL has already been loaded first (the “yes” branch from step  202 ), the method proceeds to step  204  to change the name of the target DLL module to some random or pre-arranged name that is different from the existing name. In so doing, the name change of the target DLL allows the hook DLL, which has the same file name as the name of the target DLL module prior to the name change of step  204  to be loaded (step  206 ). On the other hand, if the target DLL is not loaded (the “no” branch from step  202 ), the method also proceeds to load the hook DLL in step  206 . 
     In step  208 , the name of the hook DLL is changed. This change in the hook DLL name makes it possible for the target DLL, if it has not been loaded already as ascertained by step  202 , to be loaded. Accordingly, in step  210 , the target DLL is loaded if it is ascertained in step  220  that the target DL has not been loaded. Note that the target DLL module has a file name that is the same as the file name of the hook DLL module prior to the name change in step  208 . 
     In step  212 , the name of the target DLL is changed to a random or pre-arranged name that is known only to the hook DLL. Step  212  is also the next step if it is ascertained in step  220  that the target DLL has already been loaded. Thus, after the name change of step  212 , the target DLL is directly called only by the hook DLL since the name of the target DLL is now unknown to all other applications except for the hook DLL. 
     In step  214 , the name of the hook DLL is restored to the intended name, i.e., the name that is known to applications so that the hook DLL may be called by applications running on the computer system. The method completes in step  216 . 
       FIG. 3  shows, in accordance with an embodiment of the present invention, a code section for implementing DLL replacement by replacing the ROM-based target DLL with a RAM hook DLL in the WINDOWS CE operating system environment. 
       FIG. 4  shows, in accordance with an embodiment of the present invention, a method for replacing a ROM-based target DLL in the WINDOWS CE operating system environment. In the example of  FIG. 4 , the replacement RAM-based hook DLL has a file name that is different from the file name of the target ROM-based DLL. In step  402 , the target DLL is loaded. In step  404 , the hook DLL is loaded. Since these two DLLs have different file names, the WINDOWS CE operating system permits both DLLs to be loaded. In step  406 , the file name of the target DLL is changed to a random or pre-arranged name that is known only to the hook DLL. Thus, after the name change of step  406 , the target DLL is directly called only by the hook DLL since the name of the target DLL is now unknown to all other applications. 
     In step  408 , the file name of the hook DLL is changed to the file name that the target DLL has prior to the name change of step  406 . This name change of step  408  ensures that the hook DLL can be called by applications executing in the computer system. The method completes in step  410 . 
     As can be appreciated from the foregoing, the invention allows a target DLL to be “replaced” in the WINDOWS CE operating system environment by loading the hook DLL so that subsequent calls from applications are made to the hook DLL instead of to the original target DLL. The target DLL name is changed to a name that is known only by the hook DLL so that only the hook DLL can directly call the target DLL. Embodiments of the invention enable this DLL replacement technique even if the file name of the target DLL and the file name of the replacement hook DLL are the same prior to loading. Further, embodiments of the invention enable DLL replacement irrespective whether the target DLL or the hook DLL is loaded first during execution. 
     While this invention has been described in terms of several embodiments, there are alterations, permutations, and equivalents, which fall within the scope of this invention. For example, irrespective whether or not the target DLL is a RAM DLL, embodiments of the invention still can successfully perform DLL replacement. It should also be noted that there are many alternative ways of implementing the methods and apparatuses of the present invention. Additionally, it is intended that the abstract section, having a limit to the number of words that can be provided, be furnished for convenience to the reader and not to be construed as limiting of the claims herein. It is therefore intended that the following appended claims be interpreted as including all such alterations, permutations, and equivalents as fall within the true spirit and scope of the present invention.