Method and system for calling unknown export functions of DLL

Abstract

The invention provides a method and a system for calling unknown export functions of a DLL. The method comprises: loading a DLL file to a memory; analyzing a PE file structure to obtain export function information of the DLL file; loading a preset function parameter set; and calling DLL export functions one by one in a dynamic stack construction mode. According to the method and the system, the dynamic stack construction mode is used and sufficient parameters are provided for the export functions to use, so that all the export functions are called.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a method and a system for calling a DLL unknown export function. Background technique [0002] In the existing software, most of the application software is not composed of a single executable file, but needs to call various functions provided by other software modules. For the software under Windows, it is mainly composed of DLL (that is, dynamic Link library) to complete this function, while DLL mainly provides corresponding functions by exporting functions. There are also a lot of malicious software that encapsulates some core functions in DLL, and realizes the purpose of hiding itself through various techniques. When we dynamically detect malware, we usually run it in a virtual machine environment, and then monitor the entire system and network, and DLL cannot run independently. Generally, when using a DLL’s exported function, you need to know its function declarati...

AI Technical Summary

Problems solved by technology

[0003] Based on the above problems, the present invention proposes a method for calling an unknown DLL export function, which can be used universally, and solves the problem that unknown function parameters are unknown and cannot be called

Images