Detecting and Preventing DLL Injector Attacks

Steps (summary):

1. Create a DLL exporting the hook procedure (CALLBACK).
2. Call SetWindowsHookEx with target thread ID or NULL for system-wide:

c
 ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf” data-copycode=“true” role=“button” aria-label=“Copy Code”>Copy CodeCopied
HHOOK hHook = SetWindowsHookEx(WH_GETMESSAGE, HookProc, hDllModule, targetThreadId);

3. For system-wide hooks, the DLL must be located in a writable location and all sessions will attempt to load it.

Notes:

• Requires appropriate privileges.
• Hooks are limited to GUI-enabled processes; not effective for headless services.
• This method can be noisy and visible to the user.

3) AppInit_DLLs (legacy, not recommended)

Concept: Windows used to provide an AppInit_DLLs registry value to load DLLs into every user-mode process that loads User32.dll.

Summary:

• Set registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs with a semicolon-separated list of DLL paths.
• Requires enabling LoadAppInit_DLLs and potentially disabling Secure Boot/patch guard on newer systems.

Notes:

• Deprecated and disabled by default in modern Windows due to security.
• Not suitable for modern development or testing.

4) Manual mapping / Reflective DLL injection (advanced)

Concept: Load a DLL into a process without calling LoadLibrary, by parsing the DLL PE headers, allocating memory, copying sections, resolving imports, performing relocations, and executing its entry point. This avoids touching the IAT and can bypass some hooks and detection.

High-level steps:

1. Read DLL file into memory in the injector.
2. Parse DOS/PE headers and allocate a properly sized region in the target process with EXECUTE/READ permissions (VirtualAllocEx).
3. Write headers and sections into the target.
4. Resolve imports: for each IMAGE_IMPORT_DESCRIPTOR, locate module and function addresses, write the import table.
5. Apply relocations based on the chosen base address.
6. Create a remote thread (or use RtlCreateUserThread) to call the DLL’s entrypoint (DllMain) with DLL_PROCESS_ATTACH.

Notes:

• Complex, error-prone, and often flagged by AV/EDR.
• Useful for stealthier injection and for injecting DLLs not present on disk (loading from memory).
• Consider building the reflective loader inside the DLL itself (reflective DLL).

5) Process hollowing / code cave (overview)

Concept: Start a legitimate process in suspended state, unmap its sections, write your own executable code into it, then resume so it runs your code under the guise of the legitimate process.

Steps (summary):

• CreateProcess with CREATESUSPENDED.
• Unmap or overwrite the main image using ZwUnmapViewOfSection or similar.
• Allocate and write new image, fix context (entry point) and resume thread.

c
 ffON2NH02oMAcqyoh2UU MQCbz04ET5EljRmK3YpQ CPXAhl7VTkj2dHDyAYAf” data-copycode=“true” role=“button” aria-label=“Copy Code”>Copy CodeCopied
#include 
#include 
int wmain(int argc, wchar_t argv[]){
    if(argc<3) return -1;
    DWORD pid = (DWORD)_wtoi(argv[1]);
    const wchar_t dllPath = argv[2];
    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    LPVOID mem = VirtualAllocEx(hProc, NULL, (wcslen(dllPath)+1)2, MEM_COMMIT, PAGE_READWRITE);
    WriteProcessMemory(hProc, mem, (LPVOID)dllPath, (wcslen(dllPath)+1)2, NULL);
    LPVOID addr = GetProcAddress(GetModuleHandleW(L“kernel32.dll”), “LoadLibraryW”);
    HANDLE th = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)addr, mem, 0, NULL);
    WaitForSingleObject(th, INFINITE);
    VirtualFreeEx(hProc, mem, 0, MEM_RELEASE);
    CloseHandle(th); CloseHandle(hProc);
    return 0;
}