Method and apparatus to hook shared libraries across all processes on windows

摘要

A process page table entry (PTE) associated with a process is located, and a determination is made whether the process PTE is prototype PTE. If the process PTE is a prototype PTE, the location of the actual PTE is determined. A copy-on-write functionality associated with the PTE is disabled and the location of shared page of memory associated with the PTE determined. The shared page is modified, for example with hooking code, and the copy-on-write functionality is re-enabled.