A dll injection method and system under windows platform

Abstract

The invention relates to a dll injection method and system under a Windows platform. The dll injection method comprises the following steps: S01, preparing an injection program; S02, improving the authority of the operator; S03, sending a breakpoint event to a target process; S04, enabling the target process to respond to the breakpoint event; S05, running the target process to the breakpoint, suspending the program, storing the return address of the stack, and modifying the return address into the address of the injection program; S06, correcting the code of the injection program, and returning the code to the original return address after the code is executed; S07, enabling the target program continues to run and returning to the injection program part, and completing dll injection afterthe injection program runs; S08, enabling the target program to skip to the stored return address to continue to run, by sending the breakpoint event to the target program, modifying the breakpoint return address and skipping to the shellcode to complete dll injection. Therefore, the problem that in the prior art, dll injection cannot be conducted on the running process is solved, the success rate is high, and limited conditions are few.

Description

technical field [0001] The invention relates to the technical field of data security, in particular to a dll injection method and system under the Windows platform. Background technique [0002] DLL is the abbreviation of Dynamic Link Library, which means dynamic link library. In Windows, many applications are not a complete executable file, they are divided into some relatively independent dynamic link libraries, that is, DLL files, which are placed in the system. When we execute a certain program, the corresponding DLL file will be called, and an application program can have multiple DLL files. In the Windows operating system, each running process lives in its own program space. In theory, each process running on the operating system does not interfere with each other, that is, each process will have an independent program space. DLL injection is to put a DLL into the address space of a certain process, make it a part of that process, and let the target process load its ...

AI Technical Summary

Problems solved by technology

[0006] Aiming at the problems existing in the above-mentioned prior art, the present invention discloses a dll injection method and system under the Windows platform. The present invention utilizes sending a breakpoint event to the target program, modifying the breakpoint return address, and jumping to the shellcode to complete the dll injection , which solves the problem in the prior art that the dll cannot be injected into the running process, has a high success rate, and has few restricted conditions

Images