Method for protecting mirror image codes based on executable mirror image hiding and dll injection

Abstract

Provided is a method for protecting mirror image codes based on executable mirror image hiding and dll injection. The method comprises the following steps that 1, a target mirror image is decrypted in a memorizer; 2, a PE mirror image is loaded, wherein a dll file needed for a program is loaded, mirror image repositioning is executed, and finally OEP is executed; 3, whether an IAT of an exe module is hijacked or not is checked; 4, a Load Library and a Load Library Ex are actively hijacked, operation in the step 3 is executed on a dll mirror image of a load result, and if judgment is not abnormal, the step 5 is executed; 5, a Create Process function is hijacked, and a protection dll is injected while a subprocess is set up; 6, remote thread injection is carried out, a protected target process is injected in a Ring3 environment, and thread injection of a vicious loader is avoided; 7, a thread (THREAD_PRIORITY_BELOW_NORMAL) with low priority is built, endless loop check is carried out, whether the thread is loaded by a Debugger or not is checked, and checking is carried out once every second.

Description

technical field [0001] The invention relates to the field of system bottom security, in particular to hiding executable images, preventing malicious code injection and protecting APIs. Background technique [0002] Code injection is usually thread injection, that is, another process has higher authority, can open the Token of the target, open up a new code execution space in the target process, and write the ShellCode loaded by the hijacked dll here, and then use this Sections of code are loaded as thread functions. When the hijacked dll is loaded, the system will automatically call the DllMain entry function, and at this time the value of ul_reason_for_call is DLL_PROCESS_ATTACH. If there are codes such as Hook in DllMain at this time, then this process can be modified casually to do something that the developer does not want to happen. [0003] For code hijacking, there are basically two ways, the first is packing, and the second is code virtualization. But packing can ...

AI Technical Summary

Problems solved by technology

But packing can only protect the code statically. Once the shell is removed, the protection will be gone.

And when packing, we can go to the API in the system dll in the Hook process to monitor the target process, so this method can only be used in occasions with relatively low security requirements

However, the second code virtualization method has stronger protection, but because the code runs in a virtual machine, the performance loss is very large. If there are relatively high requirements for program running efficiency, the code virtualization method is not advisable. of

Images