An optimized management method for injecting multiple dlls into the target process

Abstract

The invention discloses an optimal management method for injecting multi-DLL (dynamic link library) into a target procedure. The method comprises the following steps: inserting an APC function in a kernel space by use of an APC mechanism, and additionally adding the optimal management on the injection DLL while injecting the injection execution DLL into the target procedure, and injecting the DLL management module in unification through an unified injection interception mechanism under the condition of needing to inject multi-DLL in the target procedure, thereby improving the target procedure stability and the entire execution efficiency of the interception function. The technical scheme disclosed by the invention has the advantages of being comprehensive in control and high in flexibility, any number of DLL can be injected, and the stability and the efficiency of the target procedure can be obviously improved in particular under the condition of the existence of multi-injection HookDLL; and the execution order of the multi-HookDLL is effectively managed by use of an injection control DLL module (ControlDLL module), the method is flexible and varied, and can be suitable for various places.

Description

technical field [0001] The application of the present invention belongs to the DLL injection technology in the computer operating system, and more specifically relates to an optimized management method for injecting multiple DLLs into a target process, so as to realize high stability and high efficiency of target process injection. Background technique [0002] With the rapid development of WINDOWS applications, WINDOWSAPI programming has been popularized and applied. In order to better collect some data at system runtime, you can use HOOKAPI (HOOK Application Programming Interface, an application programming The application layer program performs HOOK (hook) processing to intercept the required data, or enhance the existing functions. At present, when intercepting the required data through the HOOK API, it is first necessary to inject a DLL (DynamicLink Library, dynamic link library) with implementable functions into the target process to be hooked. [0003] The purpose of...

AI Technical Summary

Problems solved by technology

[0004] At present, the mainstream DLL injection technologies used by major security vendors are mainly divided into the following categories: (1) hijacking through DLL, the disadvantage is that it will take effect after restarting the computer; (2) using the registry to inject DLL, the disadvantage is that only those using The process of user32.dll cannot be revoked dynamically, it can only follow the system startup and shutdown; (3) use windows hook to inject DLL, the disadvantage is that it can only control window class messages; (4) use Trojan horse DLL to inject DLL, the disadvantage (5) Using the import table to inject the DLL, the disadvantage is that it is not flexible enough, you must first determine the name of the injected DLL and write it into the import table; (6) use the APC mechanism (Asynchronous Procedure) in the kernel space Calls, asynchronous procedure calls) insert an APC function to inject the injection execution DLL into the target process. The disadvantage is that it lacks the management of multi-injection DLL injection. When there are multiple injected DLLs and need to inject the target process at the same time, the target process Stability and efficiency are greatly affected

When there are multiple injection DLLs in the injection target process, and the same API is intercepted at the same time, each DLL will intercept this API of the target process, which increases the multiple jumps of the system execution address, and multiple interceptions seriously affect the execution of the target process. Efficiency, and multiple interceptions are very likely to cause the target process to crash

Images