A method and system for injecting dll into target process

Abstract

The invention provides a method and a system for injecting a DLL (Dynamic Link Library) into a target process. A DLL injection module used for monitoring the program start in an operating system is set; the DLL injection module is registered into the operating system; when the target process sends a start request to the operating system, the operating system informs the DLL injection module of the request; and a user inserts a target DLL to be injected into the DLL of the target process according to requirements. The method and the system have the advantages of control comprehensiveness, good concealing performance, high flexibility and the like; the method and the system can be applied to data leaking prevention and can enhance the data protection grade; all non-system key processes can be injected; an injection system explorer technology can be applied to a secure desktop technology; and the method and the system can adapt to various common operating systems such as Windows XP, Windows Server 2003 and Windows 7.

Description

technical field [0001] The present invention relates to a method and system for injecting a DLL into a target process, in particular to a method and system suitable for injecting a DLL into the target process. Background technique [0002] The purpose of DLL injection technology is to realize that the application program actively accesses the data of other processes across the process boundary, so as to control the behavior of the target process. It has a wide range of uses, which are mainly reflected in: [0003] (1) The data involved in the object you want to manipulate is not in its own process; [0004] (2) You want to intercept system functions in the target process; [0005] (3) You want to write some functions to enhance or increase the function of the target process; [0006] (4) Hide your own program (inject the main function of your own program into other processes to run, and your own process exits); [0007] From the uses listed above, it is not difficult to ...

AI Technical Summary

Problems solved by technology

[0010] Using the registry to inject DLL, the disadvantage is that it can only be injected into those processes that use user32.dll, and cannot be revoked dynamically, it can only follow the system startup and shutdown;

[0011] Use windows hook to inject DLL, the disadvantage is that it can only control window class messages;

[0012] Using remote threads to inject DLL, the disadvantage is that it is easy to be intercepted by anti-virus software;

[0013] Use Trojan DLL to inject DLL, the disadvantage is that it is difficult and heavy workload

Images