Process and system for intercepting a .NET method at runtime

[0001] This application is also related to co-pending application U.S. Ser. No. 10/714,342 entitled “Method For Dynamically Injecting User-Defined Behavior Into A Microsoft COM+ Binary Component”, which is incorporated herein by reference. This application has been abandoned.

[0002] This application is also related to co-pending application U.S. Ser. No. 10/738,785 entitled “System And Method For Conditioning Component-Based Applications”, which is incorporated herein by reference.

[0003] This application is also related to co-pending application U.S. Ser. No. 10/849,412 entitled “System And Method For Modifying A .NET Method's Behavior Non-Intrusively At Runtime By Injecting User-Defined Behavior”, which is incorporated herein by reference.

[0004] 1. Field of the Invention

[0005] The present invention generally relates to the interception of a .NET™ method at runtime in order to modify or augment a method.

[0006] 2. Description of Related Art

[0007] Extending a runtime .NET™ application cannot be done without modifying the application and redeploying the application. Also to modify the application at runtime, it is necessary to be able to intercept the .NET™ methods in the application. It is therefore necessary to devise a method in which the .NET™ methods can be intercepted. It should be noted that in the .NET™ platform an application cannot be modified unless the presently described process is applied.

[0008] Also of background interest are the .NET publications of Microsoft Corporation designated as:

[0009] “What is the Microsoft .NET™ Framework”, dated May 14, 2003 and published by the Microsoft Corporation.

[0010] An embodiment of the invention is the ability to intercept a .NET™ method.

[0011] The method of the present invention solves the problem of inability to intercept a .NET™ method in order to modify the methods behavior. The present invention here solves this problem by extending the .NET™ application at runtime. It is important to note that extending the .NET™ application means augmenting or modifying the application non-intrusively, i.e. without modifying the source code of the application.

[0012] This is accomplished by locating a .NET™ application in an associated module, then selecting a chosen method to be intercepted. A proxy for the chosen method is defined and then a “new method body” is created for the method to be intercepted. The method's new body is made to call the proxy. Apart from that, additional code be added for an interception, which will modify the method, capture information about the method, trace the method (go through method step by step) as shown in FIGS. 4A,B,C and 4D, modify behavior of the method, enforce constraints (restrictions) or modify parameters of the method.

[0013] Still other objects, features and advantages of the present invention will become readily apparent to those skilled in the art from the following detailed description, wherein is shown and described only the preferred embodiment of the invention, simply by way of illustration of the best mode contemplated of carrying out the invention. As will be realized, the invention is capable of other and different embodiments, and its several details are capable of modifications in various obvious respects, all without departing from the invention. Accordingly, the drawings and description are to be regarded as illustrative, in nature, and not as restrictive and what is intended to be protected by Letters Patent is set forth in the appended claims. The present invention will become apparent when taken in conjunction with the following description and attached drawings, wherein like characters indicate like parts, and which drawings form a part of this application.

• [0021] 1. Interception: the ability to extend (modify or augment the application non-intrusively) the runtime of the method call.
• [0022] 2. Runtime Environment: is the Microsoft's CLR (Common Language Runtime) which is the runtime engine for .NET applications.
• [0023] 3. Method: A business service operation provided by a .NET application, such as “requesting a bank balance” or “making a bank deposit”. In the context of this patent, a method can be anything, namely: method, event, property, constructor, destructor and so on.
• [0024] 4. Method Call: A call from one program to another. An example of a method call could be “getting a customers bank balance.”
• [0025] 5. NET Application: is any program that is targeted by the Microsoft's CLR (Common Language Runtime)
• [0026] 6. Interceptor: The program that enables interception.
• [0027] 7. Proxy: An intermediary program that acts as both a server and a client for the purpose of making requests on behalf of other clients. Proxies are often used as client-side portals (i.e., a trusted agent that can access the Internet on the client's behalf) through the network firewall and as helper applications for handling requests via protocols not implemented by the user agent. A software agent, often a firewall mechanism, which performs a function or operation on behalf of another application or system while hiding the details involved.
• [0028] 8. Enabling the method for interception: Allowing the method to be intercepted.
• [0029] 9. Method body: The portion of a method that contains executable statements. When a method is invoked (on a list of arguments), its body is executed within the scope of the parameter bindings, i.e., with the parameter names bound to the corresponding arguments.
• [0030] 10. Runtime: the period of time during which a program is being executed, as opposed to compile time or load time. Can also refer to the runtime environment, which designates the set of conventions that arbitrate how software is generated into executable code, how code is mapped into memory, and how functions call one another.
• [0031] 11. NET Runtime Profiler: A code profiler is a software tool, implemented as a DLL, which is called by the runtime system during the execution of an image. The profiler receives notifications each time a function is entered or exited, as well as when other events occur that are of interest to the programmer. By gathering statistics on these events, a profiler can build a comprehensive picture of which routines used the most CPU time, when garbage collections occurred, if exceptions were thrown, and so on.
• [0032] 12. IL Code: IL Assembly language which can be used to debug your .NET™ code (written in any .NET™ high level language) at low level. IL itself is in the binary format which means it can't be read by the human. But as other binary (executable) code have an assembly language, so the same way IL also has an assembly language known as IL Assembly (ILAsm). IL Assembly has the instruction in the same way as that the native assembly language have. Like, to add two numbers, you have “add” instruction, to subtract two numbers, you have “sub” instruction etc.
• [0033] 13. Tracing the method: Going through the method one step at a time.
• [0034] 14. Modifying a method's parameters: Changing colleague variables that are set to one of a number of valid values. Changing parameters will cause a Colleague module to function differently, and allow an instruction to set up controls and options to meet their individual needs.
• [0035] 15. Throwing User-Defined exceptions: Many kinds of errors can cause exceptions—problems ranging from serious hardware errors, such as a hard disk crash, to simple programming errors, such as trying to access an out-of-bounds array element. When such an error occurs within a Java method, the method creates an exception object and hands it off to the runtime system. The exception object contains information about the exception, including its type and the state of the program when the error occurred. The runtime system is then responsible for finding some code to handle the error. In Java terminology, creating an exception object and handing it to the runtime system is called throwing an exception.

[0036] One major embodiment of the invention is a process for intercepting a .NET method for the purpose of enabling method modification in order to collect runtime performance data for analysis, for tuning, for optimization, for modification of method parameters, modification of method return and other purposes.

[0037] The functionality provided by the “Interception Module”, 20i, FIG. 1B, includes the ability to intercept a method at runtime.

[0038] Reference to the cited U.S. Ser. No. 10/849,412 will further define and illustrate the following, re FIG. 5:

[0039] FIG. 5 illustrates the working environment of the modules used in runtime conditioning. A client i.e. block 5000 (personal computer, mobile device etc), has the conditioning tool user interface (UI) to apply the conditioners (22a, 22b, 22c in FIG. 5) to the methods of a .NET™ application. Using the client 5000, the user can discover the .NET™ applications on remote machines 5006 (targets 1,2, . . . N) and then apply, remove, start, or stop conditioners to the chosen .NET™ application. The methods and the applied conditioners' information are stored by the conditioning tool on the chosen target machine 5006.

[0040] A Management Server i.e. block 5002 is the machine through which the communication is done with remote machines (targets 1,2, . . . N). The management server 5002 stores information i.e. in CRC Repository block 5004 about .NET™ applications that have been chosen by the client for conditioning. The management server 5002 also stores information about the conditioners available and the conditioners which are applied to a method in a .NET™ application.

[0041] An RPC (Remote Procedure Call) mechanism is used to communicate between the client 5000, Management Server 5002 and the targets in 5006. A target i.e. blocks 1,2, . . . N, shown in 5006, is the machine of interest. The .NET™ applications on a target in 5006 are chosen to be conditioned. It is this machine 5006 that needs to be conditioned and is chosen by the client, 5000. There can be any number of targets 1,2,N involved. The target machine 5006 needs to contain the interception and conditioning infrastructures 20i in order to apply the conditioning. The targets in 5006 contain a datastore 5010, which contains information about method's and the conditioners applied on them. Module Item 5007 is the interception module. It should be noted that Items 5007-5012 are all target machines. 5010 and 5012, specifically, are databases, and 5008 is the target machine where interception is to take place.

[0042] Now referring to FIG. 1A, FIG. 1A illustrates a sketch of a .NET™ runtime system before the instigation of the present invention. FIG. 1A is a drawing illustrating how a typical .NET™ system would normally respond to a caller's request. As seen in FIG. 1A, the caller application 10b will send a request to the called application 20b, after which the called application 20b will return a response back to the caller application 10b.

[0043] In a .NET™ runtime environment, when a caller makes a request to the callee (the called application), the callee 20b processes the request by reading the parameters. In the method public int getBalance(int account), account is a parameter, if any, sent in by the caller 10b, then executing the method and returning the data (if any) back to the caller 10b. Note that the caller application and the called application could possibly be one and the same i.e. communication within the application.

[0044] FIG. 1B illustrates an improved arrangement in a diagram for intercepting a .NET™ method at runtime. Referring to FIG. 1B, the caller application 10 sends a request to the called application 20 via Interception Module 20i that forwards the request to the “called application,” 20. At this point, the called application 20 has no ability to intercept the request. But now, the called application, 20, receives the request from the called application 10, processes the request, and sends the response back to the Interception Module 20i. At this point, the Interception Module 20i can “intercept” the response, after which the response is transmitted back to the caller application, 10.

[0045] FIG. 2 shows a flow chart for enabling a .NET™ method to be intercepted. The process of enabling interception consists of the following steps:

• • [0046] E1) locate a .NET™ application on a machine.
  • [0047] E2) select the particular chosen method in the .NET™ application for interception.
  • [0048] E3) define proxies for the methods chosen to be intercepted. Note that a proxy is a substitute for the original object and is a standard computer science operation.
  • [0049] E4) create a new body (method) for the methods chosen to be intercepted.
  • [0050] E5) the method's new body is modified to call the proxies.
  • [0051] E6) enable the method for interception.

[0052] As a specific example, lets say that we have a .NET™ application called “BankApplication.exe” which contains the methods getBalance, withdraw and deposit. Step E1 (FIG. 2) would mean locating this application on disk. E2 means choosing, lets say, method “getBalance” to be intercepted. Step E3 means creating new method getBalanceProxy. Step E4 means adding code to the newly created method. Step E5 means making getBalance call to getBalanceProxy.

[0053] It should be noted that the example listed below is only an example to illustrate how one would do the aforementioned tasks with an operation for “getting a bank balance.”

[0054] Example: here the getBalance method is modified to have higher thread priority.

• • [0055] Public int getBalance(int account)
  • [0056] {
    • [0057] Balance=GetBalanceFromDatabase( );
    • [0058] return balance;
  • [0059] }
  • [0060] is modified to,
  • [0061] public int getBalance(int account)
  • [0062] {
    • [0063] int threadPriority=Thread.getPriority( );
    • [0064] Thread.SetPriority(MAX_VALUE);
    • [0065] Balance=GetBalanceFromDatabase( );
    • [0066] Thread.setPriority(threadPriority);
    • [0067] return Balance;
  • [0068] }

[0069] Referring to FIG. 3, every .NET™ application consists of a method metadata table that stores information about each of the methods in the application and their properties. This metadata table is found in the installed application, for example the BankApplication.exe. At runtime this metadata table is loaded into memory. It should be noted that the aforementioned memory is referring to the memory of .NET™ runtime. The method metadata table consists of rows of methods and their properties. Each method or each row in the metadata table consists of the following properties:

• • [0070] 1) Token: a 4-byte value representing the method. This is what is stored in the caller application's code and not the method name.
  • [0071] 2) Name: the name of the method.
  • [0072] 3) RVA (Relative Virtual Address): is the address of the method body. This is the address of the code of this method.
  • [0073] 4) Flags: indicates the method's accessibility and other characteristics.
  • [0074] 5) Imp1Flags: gives specifics of method implementation.
  • [0075] 6) Signature: describes the method signature in bytes.
  • [0076] 7) Param list: list of the parameters of the method.

[0077] Referring to FIG. 3, at runtime when a method in the module is called (say for e.g. method token 0x06000001 i.e. GetBalance which is a 4 byte token), the CLR (Common Language Runtime) looks at the metadata table and finds the method GetBalance. Then the CLR looks at the RVA of the method (in this case 0x1000) to find the method body, locates the method body using the RVA and runs the method body.

[0078] The following text describes the working of a .NET™ application runtime in more detail. This is descriptive for the exposition of FIGS. 4A, 4B, 4C and 4D:

[0079] The following discussion on Interception Module (FIG. 1B, 20i) will help illustrate FIGS. 4A, 4B, 4C & 4D:

[0080] The Interceptor 20i is developed using the Microsoft Profiling API. The Interception Module defines events published by the .NET™ runtime i.e. CLR (Common Language Runtime). There are events like module loads, method compiles etc. At runtime the CLR notifies the Interception Module whenever there is an event like a module load, a method called, a method compiled etc. Since the Interception Module is notified of these events, it has the opportunity to intercept. To enable the Interception Module to be notified of events by the CLR on a machine, it has be registered on the machine (any machine) and certain environment settings have to be set.

[0081] FIG. 4A illustrates a diagram showing the runtime of a .NET™ method. Referring to the FIG. 4A, the caller application 10 is calling the method token 0x06000001 i.e. GetBalance that exists in the called application 20. The CLR (Common Language Runtime) looks and finds the method 0x06000001 and using its RVA (Relative Virtual Address) i.e. 0x1000, locates the method body and executes the instructions in the body.

[0082] The process of enabling interception on the method GetBalance (FIG. 4A) consists of two steps: designated (i) and (ii):

• • [0083] (i) Defining a proxy method for the method (i.e. GetBalance) being intercepted:

[0084] Referring to FIG. 4B, in order to intercept the method 0x06000001 (i.e. GetBalance), then a proxy method GetBalanceProxy is defined at runtime using the Interception Module 20i which gets added to the metadata table as shown in FIG. 4B. The new method GetBalanceProxy (FIG. 4B) resembles the method GetBalance except for the name and gets assigned a new token by the CLR i.e. 0x06000004. Hence both GetBalanceProxy and GetBalance have the same RVA now i.e. 0x1000. So technically, if called, they will run the same set of instructions and produce the same results.

• • [0085] (ii) Defining a new method body for the method (i.e. GetBalance) being intercepted:

[0086] Referring to FIG. 4C, in order to intercept the method 0x06000001 i.e. GetBalance, then a “new method body” has to be created at runtime. This new method body for method GetBalance is created at runtime using the Interception Module 20i. The new method body gets assigned the value 0x4000. Then the method GetBalance's RVA is modified to the new method body i.e. 0x4000. (GetBalance New Body).

[0087] Referring to FIG. 4D, after defining the new method GetBalanceProxy (FIG. 4C) and a new method body for the method GetBalance, the method “GetBalance” is “intercept enabled”, which means the method is made ready to be intercepted, capable of being intercepted. In the method body of the method GetBalance the system can do additional work like preprocessing code, constraint checking, postprocessing code etc and also call GetBalanceProxy (which contains the code for the method GetBalance before being intercepted). The caller application with call 0x06000001 will transform to call 0x06000004 (GetBalance New Body) which then accesses RVA 0x1000 (Get Balance Proxy Body). This, then results in defining a new body for the method being intercepted.

[0088] Described herein has been a process whereby a .NET™ method in a .NET™ application can be intercepted for modification during runtime, without the need to modify the basic application or need to re-deploy the application.

[0089] As a result, many types of modifications can be enabled during runtime including such operations as changing thread priority, adjusting behavior of a method, change method parameters, and other modifications.

[0090] While one embodiment of the invention has been described, it should be understood that other variations of the invention may be developed which still fall within the scope of the attached claims.