Method and system for injecting DLL into target process

A target process and target program technology, which is applied in the field of injecting DLL into the target process, can solve the problems of non-dynamic cancellation, anti-virus software interception, heavy workload, etc., and achieve the effect of enhanced level, comprehensive control and high flexibility

Active Publication Date: 2015-11-11
中电科网络安全科技股份有限公司
View PDF4 Cites 15 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0010] Using the registry to inject DLL, the disadvantage is that it can only be injected into those processes that use user32.dll, and cannot be revoked dynamically, it can only follow the system startup and shutdown;
[0011] Use windows hook to inject DLL, the disadvant

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method and system for injecting DLL into target process

Examples

Experimental program
Comparison scheme
Effect test

specific Embodiment 1

[0040] The system for injecting the DLL into the target process includes: a DLL injection module, which monitors the start request of the target process through the operating system kernel, and injects the target DLL into the target process to respond to the operating system kernel; the target process setting module, which sets the target process to be injected; The system kernel notifies the DLL injection module after receiving the process start request, and waits for the response of the DLL injection module, and notifies the process to start loading the DLL in the import list after receiving the response; the DLL injection module also includes a judgment module, which judges whether the process requested to start is for the target process.

[0041] The method of injecting the DLL into the target process is as follows: the kernel modifies the process PE memory mechanism, and injects the target DLL with the control function into the target process import table. In this way, th...

specific Embodiment 2

[0048] Based on the first embodiment, the system further includes: an old import table recovery module of the target process, which restores the address and data of the old import table after the DLL of the target process is loaded.

[0049] If the startup process is the target process, after the target process finishes loading the DLL in the import table, restore the old import table of the target process. Find a suitable memory space for saving the new import table, construct a new import table to replace the old import table, and restore the old import table after the DLL is injected into the target process, so that the process verification can be fooled and the initial environment of the target process is not Change.

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention provides a method and a system for injecting a DLL (Dynamic Link Library) into a target process. A DLL injection module used for monitoring the program start in an operating system is set; the DLL injection module is registered into the operating system; when the target process sends a start request to the operating system, the operating system informs the DLL injection module of the request; and a user inserts a target DLL to be injected into the DLL of the target process according to requirements. The method and the system have the advantages of control comprehensiveness, good concealing performance, high flexibility and the like; the method and the system can be applied to data leaking prevention and can enhance the data protection grade; all non-system key processes can be injected; an injection system explorer technology can be applied to a secure desktop technology; and the method and the system can adapt to various common operating systems such as Windows XP, Windows Server 2003 and Windows 7.

Description

technical field [0001] The invention relates to a method and a system for injecting a DLL into a target process, in particular to a method and a system suitable for injecting a DLL into a target process. Background technique [0002] The purpose of DLL injection technology is to enable applications to actively access data of other processes across process boundaries, thereby controlling the behavior of the target process. It has a wide range of uses, mainly reflected in: [0003] (1) The data involved in the object you want to manipulate is not in its own process; [0004] (2) You want to intercept system functions in the target process; [0005] (3) You want to write some functions to enhance or increase the function of the target process; [0006] (4) Hide your own program (inject the main function of your own program into other processes to run, and your own process exits); [0007] From the uses listed above, it is not difficult to see that DLL injection technology c...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
IPC IPC(8): G06F9/44
Inventor 曾承
Owner 中电科网络安全科技股份有限公司
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap