ALEXANDRIA, Va., March 26 -- United States Patent no. 12,259,967, issued on March 25, was assigned to SentinelOne Inc. (Mountain View, Calif.).
"Preserving DLL hooks" was invented by Anil Gupta (Bangalore, India) and Harinath Vishwanath Ramchetty (Bangalore, India).
According to the abstract* released by the U.S. Patent & Trademark Office: "DLL hooks are protected by mapping the starting address of the new executable to a sample of the former executable. Attempts to read the starting address are responded to with the sample of the former executable. Attempts to write to the starting address are responded to with confirmation of success without actually writing data. Debuggers are detected upon launch or by evaluating an operating system. ...