Dynamic link library injection method and device, equipment and storage medium

Abstract

The invention discloses a dynamic link library injection method and device, equipment and a storage medium; the method comprises the steps of opening a target process to obtain a target process handle, requesting a target operation authority set of the target process, wherein operation authorities in the target operation authority set are operation authorities needed for dynamic link library injection; obtaining a memory space; packaging related logic used for injecting the dynamic link library based on an operating system callback mechanism to obtain a loading function, and storing a path of the dynamic link library and the loading function in the memory space; and setting a callback function based on the loading function, the callback function being used for being automatically called by the operating system when the operating system reaches a preset state so as to run the loading function in a target process. According to the invention, the required target operation authority is few, the thread management and monitoring in the target process can be bypassed, and less callback function information is disclosed, so that the dynamic link library injection success rate is higher.

Description

technical field [0001] The invention relates to the field of dynamic link library injection, in particular to a dynamic link library injection method, device, equipment and storage medium. Background technique [0002] In the prior art, it usually relies on calling the remote thread calling function provided by the operating system to create a new thread in the target process, and use the new thread as the carrier of the dynamic link library injection operation to realize the injection of the dynamic link library . [0003] However, this injection method of the dynamic link library is executed inside the target process, which is easily perceived by the target process, resulting in the failure of the dynamic link library injection, and this injection method needs to obtain a large number of operating permissions of the target process, thereby improving the dynamic link. The injection difficulty of the library. Contents of the invention [0004] In order to increase the co...

AI Technical Summary

Problems solved by technology

[0003] However, this injection method of the dynamic link library is executed inside the target process, which is easily perceived by the target process, resulting in the failure of the dynamic link library injection, and this injection method needs to obtain a large number of operating permissions of the target process, thereby improving the dynamic link. Library injection difficulty

Images