METHOD AND SYSTEM FOR INTERCEPTING .NET CALLS BY MEANS OF PATCHES IN INTERMEDIATE LANGUAGE Russian patent published in 2024 - IPC G06F21/14 G06F8/40 

FIELD: physics.

SUBSTANCE: invention relates to methods of intercepting .NET calls. Technical result is achieved due to the fact that at the preparatory stage for implementing the method, the following steps are performed: identifying a .NET library directory; for each version of the .NET library, identifying a class from a predefined set of classes; method from a predefined set of methods is identified in the identified class; identified method is changed by adding payload, which initiates logging start and transfer of control from system library to detection module; storing the modified method; in response to detecting native images, hiding the native image library containing the identified class from the native images directory; generating a modified native image library; replacing the native image library with the modified native image library; then, at the working stage, in response to the .NET call by the application of the modified method or the modified native image library, starting the logging and transferring control from the system library to the post-processing module; saving the log and transmitting it for analysis to the post-processing module; and returning control to .NET application.

EFFECT: implementation of interception of calls inside .NET platform.

18 cl, 4 dwg