A dynamic link library injection method, device, equipment and storage medium
By using dynamic link library injection through the operating system callback mechanism, the target's access permissions are reduced. The callback function automatically executes the loading function in a specific state of the operating system, which solves the problems of easy detection and permission dependence in existing technologies, and achieves a higher success rate and stealth.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-05-08
- Publication Date
- 2026-03-27
AI Technical Summary
In existing technologies, dynamic link library injection methods are easily detected by the target process and require obtaining a large number of operation privileges, resulting in high injection difficulty and poor concealment.
A dynamic link library injection method based on the operating system callback mechanism is adopted. By obtaining reduced target operation permissions, the injection is performed by automatically calling the loading function when the operating system reaches a preset state, thus avoiding the creation of remote threads in the target process.
It improves the success rate and stealth of dynamic link library injection, reduces the dependence on the target process's operation permissions, and increases the difficulty of reverse analysis.
Smart Images
Figure CN113703859B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of dynamic link library injection, and in particular to a dynamic link library injection method, device, equipment and storage medium. BACKGROUND
[0002] In the prior art, a remote thread calling function provided by an operating system is usually called to create a new thread in a target process, and the new thread is used as a carrier of a dynamic link library injection operation to implement the injection of the dynamic link library.
[0003] However, this injection method of the dynamic link library is executed in the internal of the target process, and is easy to be perceived by the target process, thereby leading to the failure of the injection of the dynamic link library, and the injection method needs to obtain a large number of operation permissions of the target process, thereby increasing the difficulty of the injection of the dynamic link library. SUMMARY
[0004] In order to increase the concealment of the injection of the dynamic link library, improve the success rate of the injection of the dynamic link library, and reduce the dependence of the injection of the dynamic link library on the operation permissions of the target process, an embodiment of the present application provides a dynamic link library injection method, device, equipment and storage medium.
[0005] In one aspect, the present application provides a dynamic link library injection method, and the method comprises:
[0006] opening a target process to obtain a target process handle, and requesting a target operation permission set of the target process, wherein the operation permissions in the target operation permission set are operation permissions required for the injection of the dynamic link library;
[0007] obtaining a memory space;
[0008] encapsulating related logic for the injection of the dynamic link library based on an operating system callback mechanism to obtain a loading function, and storing a path of the dynamic link library and the loading function in the memory space;
[0009] setting a callback function based on the loading function, wherein the callback function is used to be called by the operating system itself when the operating system reaches a preset state, so as to run the loading function in the target process.
[0010] In another aspect, the present application provides a dynamic link library injection device, and the device comprises:
[0011] a target process handle obtaining module, configured to open a target process to obtain a target process handle, and request a target operation permission set of the target process, wherein the operation permissions in the target operation permission set are operation permissions required for the injection of the dynamic link library;
[0012] The memory space obtaining module is configured to obtain a memory space;
[0013] The loading function encapsulating module is configured to encapsulate related logic for injecting the dynamic link library based on an operating system callback mechanism, to obtain a loading function, and to store a path of the dynamic link library and the loading function in the memory space.
[0014] The callback function setting module is configured to set a callback function based on the loading function, the callback function being configured to be called by the operating system itself when the operating system reaches a preset state, so as to run the loading function in the target process.
[0015] In another aspect, the present application provides a computer readable storage medium, characterized in that the computer readable storage medium stores at least one instruction or at least one program, the at least one instruction or at least one program is loaded and executed by a processor to implement the above-mentioned dynamic link library injection method.
[0016] In another aspect, the present application provides a dynamic link library injection device, characterized in that the device comprises a processor and a memory, the memory stores at least one instruction or at least one program, the at least one instruction or at least one program is loaded and executed by the processor to implement the above-mentioned dynamic link library injection method.
[0017] The present application provides a dynamic link library injection method, device, equipment and storage medium. The present application realizes the injection of dynamic link library based on callback function, requires less target operation permission, and does not need to create remote threads in the target process, can bypass the thread management and monitoring restrictions in the target process, and uses less callback function related information disclosure, so as to bypass the detection of the target process, improve the difficulty of reverse analysis, and thus make the injection success rate of dynamic link library higher. BRIEF DESCRIPTION OF DRAWINGS
[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art and the advantages thereof, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.
[0019] Figure 1 is a method flowchart provided by the present application for dynamic link library injection in the prior art;
[0020] Figure 2 is a dynamic link library injection method flowchart provided by the present application;
[0021] Figure 3 is a loading function encapsulation module block diagram provided by the application.
[0022] Figure 4 is a third function segment for loading dynamic link library based on operating system callback mechanism provided by the application, and the third function segment runs the flowchart based on the stack space.
[0023] Figure 5 is a dynamic link library injection method execution schematic diagram provided by the application.
[0024] Figure 6 is a dynamic link library injection device block diagram provided by the application.
[0025] Figure 7 is a loading function encapsulation module block diagram provided by the application.
[0026] Figure 8 is a hardware structure schematic diagram of a device for implementing the method provided by the embodiment of the application. DETAILED DESCRIPTION
[0027] The technical solutions in the embodiments of the application will be clearly and completely described below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the application.
[0028] It should be noted that the terms "first", "second" and the like in the specification and claims of the application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not necessarily have to include all the steps or units clearly listed, but can include other steps or units not clearly listed or inherent to the process, method, product or device.
[0029] In order to make the purposes, technical solutions and advantages of the embodiments of the application clearer and more apparent, the embodiments of the application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the application, and are not used to limit the embodiments of the application.
[0030] Hereinafter, the terms "first", "second" are only used for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the embodiments, unless otherwise stated, the meaning of "a plurality of" is two or more. In order to facilitate understanding of the technical solutions described in the embodiments of the present application and the technical effects generated thereby, the present application first explains the related professional terms:
[0031] DLL: Dynamic Link Library. DLL is a library containing code and data that can be used by multiple programs at the same time. In the Windows operating system, such DLL files are called application extensions.
[0032] DLL injection: Put a DLL file into the address space of a process (target process) so that it becomes part of the target process. DLL injection technology can be used to add / extend other extensions in the application, debug or reverse engineer the application. Of course, DLL injection technology can also be maliciously used to damage the target program.
[0033] API function: API (Application Programming Interface) function is a pre-defined function. In addition to coordinating the execution of application programs, memory allocation, system resource management, the operating system is also a service center, calling various services of this service center (each service is an API function), which can help the application program to achieve the purpose of opening a window, drawing graphics, using peripheral devices, etc.
[0034] Windows operating system: Microsoft Windows operating system is a set of operating systems developed by the United States Microsoft Corporation, which adopts a graphical mode graphic device interface and is more user-friendly. With the continuous upgrading of computer hardware and software, Microsoft's Windows has been continuously upgraded, from the 16-bit, 32-bit to 64-bit architecture, and from the original Windows 1.0 to Windows 95, Windows 98, Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10 and Windows Server server enterprise operating system, continuously updated.
[0035] Handle: A unique integer used in the Windows operating system to identify an object created or used by an application. The Windows operating system uses a variety of handles to identify various resources such as application instances, windows, controls, bitmaps, graphics device interface objects, and so on.
[0036] Assembly language: A low-level language used for electronic computers, microprocessors, microcontrollers, or other programmable devices. In different devices, assembly language corresponds to different machine language instruction sets. An assembly language is specific to a certain computer system architecture.
[0037] Loader instruction: A load instruction is a specially constructed assembly language code that is written into the space corresponding to the target process during the DLL injection process, used to load the DLL file.
[0038] The prior art method for dynamic link library injection, as shown in Figure 1 includes the following steps:
[0039] S1. Open the target process to obtain the target process handle, request a set of target operation permissions for the target process, and the operation permissions in the set of target operation permissions are the operation permissions required for dynamic link library injection.
[0040] In fact, the content of the set of target operation permissions is related to the dynamic link library injection method used, and different methods require different target operation permissions. In the prior art, a remote thread needs to be created in the target process, and the injection of the dynamic link library is realized through the created remote thread. This technical solution requires at least five target operation permissions in the Windows operating system. Specifically, the five target operation permissions are:
[0041] PROCESS_CREATE_THREAD: Thread creation permission
[0042] PROCESS_QUERY_INFORMATION: Query information permission
[0043] PROCESS_VM_OPERATION: Memory operation permission
[0044] PROCESS_VM_WRITE: Memory write permission
[0045] PROCESS_VM_READ: Memory read permission
[0046] In a feasible implementation, the handle of the target process can be obtained by calling the OpenProcess function to open the target process in the Windows operating system.
[0047] S3. Create a remote thread based on the target process handle, and load a dynamic link library file by the remote thread based on the target operation permission set.
[0048] Specifically, the creation of the remote thread can be implemented by using a CreateRemoteThread function or a QueueUserAPC function in the Windows operating system. The running of the QueueUserAPC function additionally requires a THREAD_SET_CONTEXT permission.
[0049] Specifically, when the CreateRemoteThread function is used, the creation of the remote thread is implemented by using an underlying call of an RtlCreateUserThread function and an NtCreateThreadEx function. In this process, the operation permission corresponding to the target operation permission set needs to be used.
[0050] The above-mentioned method for implementing the injection of the dynamic link library needs to obtain a plurality of target process permissions. For example, the five operation permissions of the target process need to be obtained in advance when the CreateRemoteThread function is used. Further, the remote thread needs to be created or used to execute the code in the target process to load the dynamic link library file, and in this process, the target process is easily perceived. If the target process sets a thread initialization callback, the new thread created by the functions such as the CreateRemoteThread function will be intercepted, thereby causing the injection of the dynamic link library to fail.
[0051] In order to increase the concealment of the injection of the dynamic link library, improve the success rate of the injection of the dynamic link library, and reduce the dependence of the injection of the dynamic link library on the operation permission of the target process, an embodiment of the present application provides a dynamic link library injection method, as shown in the following. Figure 2 The method comprises the following steps.
[0052] S101. Open a target process to obtain a target process handle, and request a target operation permission set of the target process, wherein the operation permission in the target operation permission set is an operation permission required for the injection of the dynamic link library.
[0053] In fact, the content of the target operation permission set is related to the method for injecting the dynamic link library, and different methods need to obtain different target operation permissions. The embodiment of the present application performs the injection of the dynamic link library based on the callback mechanism of the operating system, and the demand for the target operation permission is obviously reduced compared with the prior art.
[0054] The specific permission content of the target operation permission set requested in step S101 is related to the method used in the subsequent steps. In the embodiment of the present application, the injection of the dynamic link library is based on the operating system callback mechanism, and the target operation permission set at least includes PROCESS_SET_INFORMATION (set process information permission) and PROCESS_VM_WRITE two permissions.
[0055] In the Windows operating system, the handle of the target process can be obtained by calling the OpenProcess function to open the target process, and the target operation permission set can also be obtained by the OpenProcess function.
[0056] S103. Obtain the memory space.
[0057] In the embodiment of the present application, the injection of the dynamic link library is based on the operating system callback mechanism, and the memory space can be used to store the related logic of the injection of the dynamic link library based on the operating system callback mechanism. In a specific embodiment, the memory space includes a first memory space and a second memory space, the first memory space is used to store the dynamic link library path information, and the second memory space is used to store the dynamic link library injection logic.
[0058] In a feasible implementation, the memory space can be obtained by allocating memory space in the target process. Because the memory space needs to be allocated in the target process, the PROCESS_VM_OPERATION permission is required. Accordingly, the target operation permission set consists of three elements, PROCESS_SET_INFORMATION, PROCESS_VM_WRITE and PROCESS_VM_OPERATION.
[0059] In order to obtain the target handle and the target operation permission, the following code can be used to execute step S101:
[0060] hProcess=OpenProcess(PROCESS_SET_INFORMATION|PROCESS_VM_OPERATION|PROCESS_VM_WRITE,false,dwPid);
[0061] Wherein dwPid is the target process identifier, and hProcess is the target process handle obtained.
[0062] The target process handle is returned after the OpenProcess call, and then the target process handle, the required memory size, and the memory permission PROCESS_VM_OPERATION are passed to another Windows operating system API function VirtualAllocEx to achieve the purpose of memory allocation in the target process. VirtualAllocEx returns an address of the allocated memory space.
[0063] In another possible implementation, the memory space can be obtained in the existing memory. This implementation does not need to allocate space in the target memory, and thus does not need to obtain the PROCESS_VM_OPERATION permission. Accordingly, the target operating permission set consists of two elements, PROCESS_SET_INFORMATION and PROCESS_VM_WRITE.
[0064] To obtain the target handle and the target operating permission, the following code can be used to perform step S101:
[0065] hProcess = OpenProcess(PROCESS_SET_INFORMATION | PROCESS_VM_WRITE, false, dwPid);
[0066] Where dwPid is the target process identifier, and hProcess is the obtained target process handle.
[0067] The target operating permission set requested by the two schemes for realizing dynamic link library injection in the embodiments of the present application using different memory obtaining methods can be different, and the corresponding element number can be two or three. Obviously, the element number of the target operating permission set is far less than the five permissions required by the prior art to realize dynamic link library injection, greatly reducing the number of permissions to be obtained and lowering the requirements for dynamic link library injection.
[0068] S105. Packaging the related logic for dynamic link library injection based on the operating system callback mechanism to obtain a loading function, and storing the path of the dynamic link library and the loading function in the memory space.
[0069] The loading function is written in the path of the dynamic link library, and the injection of the dynamic link library is realized by running the loading function. The construction of the loading function is the key to realizing dynamic link library injection. In the embodiments of the present application, the loading function is also called Loader, and the Loader needs to be constructed to correctly load the dynamic link library.
[0070] In a feasible embodiment, the encapsulation is used for the injection of the dynamic link library based on the operating system callback mechanism, and a loading function is obtained, as shown in Figure 3
[0071] S1051. A first function segment for saving the current operating system state is constructed.
[0072] The embodiment of the present application injects the dynamic link library based on the operating system callback mechanism, and the loading function can be directly run when the callback condition is met. In order to ensure that the running process does not cause damage to the state of the operating system, the current state of the operating system is first saved in the embodiment of the present application.
[0073] In the Windows 32-bit operating system, the pushad and pushfd can be used to save the register information, and in the Windows 64-bit operating system, the push command can be used to save the 16 registers from rax to r15.
[0074] S1053. A second function segment for allocating stack space is constructed.
[0075] S1055. A third function segment for loading the dynamic link library based on the operating system callback mechanism is constructed, and the third function segment is run based on the stack space.
[0076] In a feasible embodiment, in order to avoid the abnormality caused by the injection of the dynamic link library multiple times, the third function segment can be improved, and an atomic lock is added to ensure that the dynamic link library is injected only once. Specifically, the third function segment for loading the dynamic link library based on the operating system callback mechanism is constructed, and the third function segment is run based on the stack space, as shown in Figure 4
[0077] S10551. An atomic lock is created, and the atomic lock is used to ensure that the dynamic link library is loaded only once.
[0078] In a feasible embodiment, the present application provides the pseudo code of the atomic lock:
[0079] It is judged whether the atomic lock [Lock IsOpen] is 0 or not. If it is not 0, the execution step protected by the atomic lock is not executed.
[0080] If the atomic lock [Lock IsOpen] is 0, the value of the atomic lock is modified to be non-zero.
[0081] The atomic lock is used to achieve the technical effect that if the code corresponding to the atomic lock is run for the first time, the execution steps protected by the atomic lock can be successfully run, and if the code corresponding to the atomic lock is run again, the execution steps protected by the atomic lock cannot be executed, thereby avoiding the execution function for loading the dynamic link library protected by the atomic lock from being repeatedly executed.
[0082] S10553. Inserting an execution function for loading a dynamic link library.
[0083] In the constructed stack space, the third function segment guarantees that the current code is only executed once by using an atomic lock, and then realizes the loading of the dynamic link library by running the execution function, which can be constructed based on LoadLibrary or LdrLoadDll, both of which are Windows operating system functions, and the embodiments of the present application do not repeat them.
[0084] S1057. Constructing a fourth function segment for recycling the stack space.
[0085] S1059. Constructing a fifth function segment for restoring the operating system state according to the saved current operating system state.
[0086] S10511. Packaging the first function segment, the second function segment, the third function segment, the fourth function segment, and the fifth function segment to obtain a loading function.
[0087] S107. Setting a callback function based on the loading function, the callback function being used for being called by the operating system itself when the operating system reaches a preset state so as to run the loading function in the target process.
[0088] In fact, after the callback function is successfully set, the loading function in the callback function can be run when the operating system reaches the preset state, thereby completing the injection of the dynamic link library.
[0089] In the Windows operating system, the system function NtSetInformationProcess function thereof can be used as the callback function, the content information of ProcessInstrumentationCallback of the target process is set based on the NtSetInformationProcess function, the loading function is executed, and the injection of the dynamic link library is realized.
[0090] The NtSetInformationProcess function is a system function that is not disclosed in the official documentation of the Windows operating system, and therefore the prior art does not disclose the use method and function of the function. Through research on the NtSetInformationProcess function, the embodiments of the present application determine that the NtSetInformationProcess function is a powerful API function, and various key information of a target process can be set by calling the function. The function accepts four parameters: a process handle, an information category, information content, and an information length.
[0091] In order to run the loading function based on the callback function to achieve the purpose of injecting a dynamic link library in the target process, the callback function is set as follows in the embodiments of the present application:
[0092] (1) passing the target process handle as a parameter to the callback function;
[0093] (2) setting the value of ProcessInstrumentationCallback in the information category to 40;
[0094] (3) setting the information content to a pointer to the storage address of the loading function;
[0095] (4) setting the information length according to the operating system.
[0096] The information length is different according to different operating systems, such as 4 for Windows 7 x86, 8 for Windows 7 x64, 12 for Windows 10 x86, and 16 for Windows 10 x64. By setting the 40th information, the operating system will read the address of the loading function in the information content set by NtSetInformationProcess when switching the privilege instruction level of the CPU processor from r0 to r3, and directly call the instruction code at the address, so that the constructed loading function code is executed and the DLL injection is finally achieved.
[0097] Compared with the prior art scheme of injecting a dynamic link library by creating a remote thread, the injection timing of the dynamic link library is obviously different. For example, Figure 5As shown, the embodiment of the present application sets a callback function, and the callback function can be executed only when the operating system switches the privilege instruction level, and the target process can be injected with the dynamic link library. This scheme does not need to create a thread in the target process, and thus can bypass the requirements and interception of the thread creation inside the target process, bypass the detection of the number and starting address of the threads of the target process, and has higher stability and concealment. The callback function in the embodiment of the present application can run in the 32-bit and 64-bit operating systems of Microsoft Windows7 / Window8 / Windows8.1 / Windows10.
[0098] The dynamic link library injection method disclosed by the embodiment of the present application realizes the injection of the dynamic link library based on the callback function, requires less target operation permission, and does not need to create a remote thread in the target process, can bypass the thread management and monitoring and other limiting measures in the target process, uses less disclosed callback function related information, and thus can bypass the detection of the target process, improve the difficulty of reverse analysis, and thus make the success rate of the injection of the dynamic link library higher.
[0099] The embodiment of the present application discloses a dynamic link library injection device, as shown in the figure, Figure 6 The device comprises:
[0100] The target process handle acquisition module 201 is configured to open a target process to acquire a target process handle, and request a target operation permission set of the target process, wherein the operation permissions in the target operation permission set are operation permissions required for dynamic link library injection.
[0101] The target operation permission set at least comprises two permissions of PROCESS_SET_INFORMATION and PROCESS_VM_WRITE.
[0102] The memory space acquisition module 203 is configured to acquire a memory space.
[0103] Specifically, the memory space acquired by the memory space acquisition module 203 comprises a first memory space and a second memory space, the first memory space is configured to store dynamic link library path information, and the second memory space is configured to store dynamic link library injection logic.
[0104] In the embodiment of the present application, the memory space can be acquired by allocating a memory space in the target process or using an existing memory.
[0105] The loading function encapsulation module 205 is configured to encapsulate related logic for the injection of the dynamic link library based on the operating system callback mechanism, obtain a loading function, and store the path of the dynamic link library and the loading function in the memory space.
[0106] The callback function setting module 207 is used to set a callback function based on the loading function. The callback function is used to be called by the operating system itself when the operating system reaches a preset state so that the loading function can be run in the target process.
[0107] In the Windows operating system, the system function NtSetInformationProcess can be used as a callback function. The content information of the ProcessInstrumentationCallback of the target process can be set based on the NtSetInformationProcess function, and the loading function can be executed to achieve dynamic link library injection.
[0108] In order to execute the loading function based on the callback function to inject the dynamic link library into the target process, the callback function is configured as follows in this embodiment of the invention:
[0109] (1) Pass the target process handle as a parameter to the callback function;
[0110] (2) Set the value of ProcessInstrumentationCallback in the information category to 40;
[0111] (3) Set the information content to a pointer to the storage address of the loaded function;
[0112] (4) Set the information length according to the operating system.
[0113] The length of the information varies depending on the operating system. For example, it is 4 characters in Windows 7 x86, 8 characters in Windows 7 x64, 12 characters in Windows 10 x86, and 16 characters in Windows 10 x64. By setting information number 40, the operating system will read the address of the loaded function from the information set by NtSetInformationProcess when the CPU switches from privileged instruction level r0 to r3, and directly call the instruction code at that address. This allows the constructed loaded function code to be executed, ultimately achieving DLL injection.
[0114] Specifically, such as Figure 7 As shown, the loading function encapsulation module 205 includes:
[0115] The first function segment construction unit 2051 is used to construct a first function segment for saving the current operating system state.
[0116] The second function segment construction unit 2053 is used to construct the second function segment for allocating stack space.
[0117] A third function segment construction unit 2055 is configured to construct a third function segment for loading a dynamic link library based on an operating system callback mechanism, and the third function segment is configured to run based on the stack space.
[0118] Specifically, the third function segment construction unit 2055 can create an atomic lock, which is configured to ensure that the dynamic link library is loaded only once, and insert an execution function for loading the dynamic link library.
[0119] A fourth function segment construction unit 2057 is configured to construct a fourth function segment for recycling the stack space.
[0120] A fifth function segment construction unit 2059 is configured to construct a fifth function segment for restoring an operating system state according to a saved current operating system state.
[0121] An encapsulation unit 20511 is configured to encapsulate the first function segment, the second function segment, the third function segment, the fourth function segment, and the fifth function segment to obtain a loading function.
[0122] Specifically, the dynamic link library injection device and the method embodiment disclosed in the present application are based on the same inventive concept. For details, please refer to the method embodiment, which will not be described here.
[0123] The embodiment of the present application further provides a computer readable storage medium, which can store a plurality of instructions. The instructions can be adapted to be loaded by a processor and execute a dynamic link library injection method disclosed in the embodiment of the present application, and the method comprises at least the following steps:
[0124] A dynamic link library injection method, the method comprises:
[0125] Opening a target process to obtain a target process handle, requesting a target operation permission set of the target process, and the operation permission in the target operation permission set is an operation permission required for dynamic link library injection;
[0126] Obtaining a memory space;
[0127] Encapsulating related logic for dynamic link library injection based on an operating system callback mechanism to obtain a loading function, and storing a path of the dynamic link library and the loading function in the memory space;
[0128] Setting a callback function based on the loading function, and the callback function is configured to be called by the operating system to run the loading function in the target process when the operating system reaches a preset state.
[0129] In a preferred embodiment, the obtaining memory space comprises obtaining a first memory space and a second memory space, the first memory space is used for storing dynamic link library path information, and the second memory space is used for storing dynamic link library injection logic.
[0130] In a preferred embodiment, the obtaining memory space comprises allocating memory space in the target process; correspondingly, the target operation permission set comprises three elements, namely, setting process information permission, memory write permission and memory operation permission.
[0131] Or,
[0132] The obtaining memory space comprises obtaining memory space in existing memory; correspondingly, the target operation permission set comprises two elements, namely, setting process information permission and memory write permission.
[0133] In a preferred embodiment, the encapsulating logic for injecting a dynamic link library based on an operating system callback mechanism to obtain a loading function comprises:
[0134] Constructing a first function segment for saving the current operating system state;
[0135] Constructing a second function segment for allocating stack space;
[0136] Constructing a third function segment for loading a dynamic link library based on an operating system callback mechanism, the third function segment being run based on the stack space;
[0137] Constructing a fourth function segment for recycling the stack space;
[0138] Constructing a fifth function segment for restoring the operating system state according to the saved current operating system state;
[0139] Encapsulating the first function segment, the second function segment, the third function segment, the fourth function segment and the fifth function segment to obtain a loading function.
[0140] In a preferred embodiment, the constructing a third function segment for loading a dynamic link library based on an operating system callback mechanism, the third function segment being run based on the stack space, comprises:
[0141] Creating an atomic lock, the atomic lock being used to ensure that the dynamic link library is loaded only once;
[0142] Inserting an execution function for loading a dynamic link library.
[0143] In a preferred embodiment, in the Windows operating system, the system function NtSetInformationProcess is used as a callback function. The four parameters of the NtSetInformationProcess function are the process handle, information category, information content, and information length, respectively. The step of setting the callback function based on the loading function includes:
[0144] Set the process handle to the target process handle;
[0145] Configure the information category so that the callback function is executed when the operating system privilege instruction level is switched;
[0146] The information content is set to a pointer to the storage address of the loaded function;
[0147] The length of the information is set according to the operating system.
[0148] Furthermore, Figure 8 A schematic diagram of the hardware structure of a device for implementing the method provided in the embodiments of the present invention is shown. This device may participate in or include the apparatus or system provided in the embodiments of the present invention. Figure 8 As shown, device 10 may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 8 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, device 10 may also include a... Figure 8 The more or fewer components shown, or having the same Figure 8 The different configurations shown.
[0149] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the device 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).
[0150] The memory 104 can be used to store software programs of application software and modules, such as program instructions / data storage means corresponding to the method of the embodiments of the present application, and the processor 102 can execute various functional applications and data processing by running the software programs and modules stored in the memory 104, i.e. implement the above-mentioned dynamic library injection method. The memory 104 can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory 104 can further include memories remotely arranged with respect to the processor 102, which can be connected to the device 10 through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0151] The transmission device 106 is used to receive or send data via a network. The specific examples of the above-mentioned network can include a wireless network provided by the communication provider of the device 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet in a wireless manner.
[0152] The display can be, for example, a touch screen type liquid crystal display (LCD), which can enable a user to interact with the user interface of the device 10 (or mobile device).
[0153] It should be noted that the above-mentioned sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are possible or can be advantageous.
[0154] Each of the embodiments in the present specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment mainly explains the differences from other embodiments. In particular, for the device and server embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiments.
[0155] Those skilled in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or can be instructed to relevant hardware by program. The program can be stored in a computer readable storage medium, and the storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.
[0156] The above description is merely preferred embodiments of the present application, and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A dynamic link library injection method, characterized by, The method comprises: opening a target process to obtain a target process handle, requesting a target operation permission set of the target process, and the operation permission in the target operation permission set being an operation permission required for dynamic link library injection; obtaining a memory space; encapsulating related logic for dynamic link library injection based on an operating system callback mechanism to obtain a loading function, the related logic being used for dynamic link library injection through the system callback mechanism without creating a thread; storing a path of the dynamic link library and the loading function in the memory space; setting a callback function based on the loading function, the callback function being used for being called by the operating system itself when the operating system reaches a preset state without creating a thread so as to run the loading function in the target process.
2. The method of claim 1, wherein, The obtaining of the memory space comprises obtaining a first memory space and a second memory space, the first memory space being used for storing dynamic link library path information, and the second memory space being used for storing dynamic link library injection logic.
3. The method of claim 1 or 2, wherein: the obtaining of the memory space comprises allocating a memory space in the target process; and correspondingly, the target operation permission set comprises three elements, namely, a process information setting permission, a memory write permission and a memory operation permission; or, the obtaining of the memory space comprises obtaining a memory space in an existing memory; and correspondingly, the target operation permission set comprises two elements, namely, a process information setting permission and a memory write permission.
4. The method of claim 1, wherein, The encapsulating of the related logic for dynamic link library injection based on the operating system callback mechanism to obtain the loading function comprises: constructing a first function segment for saving a current operating system state; constructing a second function segment for allocating a stack space; constructing a third function segment for loading the dynamic link library based on the operating system callback mechanism, the third function segment being run based on the stack space; constructing a fourth function segment for recycling the stack space; constructing a fifth function segment for restoring the operating system state according to the saved current operating system state; and encapsulating the first function segment, the second function segment, the third function segment, the fourth function segment and the fifth function segment to obtain the loading function.
5. The method of claim 4, wherein, The constructing of the third function segment for loading the dynamic link library based on the operating system callback mechanism, the third function segment being run based on the stack space, comprises: creating an atomic lock, the atomic lock being used for ensuring that the dynamic link library is loaded only once; inserting an execution function for loading the dynamic link library.
6. The method of claim 1, wherein, In the Windows operating system, a system function NtSetInformationProcess function thereof is used as the callback function, four parameters of the NtSetInformationProcess function being a process handle, an information category, information content and an information length; and the setting of the callback function based on the loading function comprises: setting the process handle as the target process handle; setting the information category so that the callback function is executed when an operating system privilege instruction level is switched. The setting information content is a pointer of a storage address of the loading function; According to the operating system, the setting information length is set.
7. A dynamic link library injection apparatus, characterized by, The device comprises: A target process handle acquisition module is configured to open a target process to acquire a target process handle, and request a target operation permission set of the target process, wherein an operation permission in the target operation permission set is an operation permission required for dynamic link library injection; A memory space acquisition module is configured to acquire a memory space; A loading function encapsulation module is configured to encapsulate related logic for dynamic link library injection based on an operating system callback mechanism to obtain a loading function, wherein the related logic is used to perform dynamic link library injection through the system callback mechanism without creating a thread; The path of the dynamic link library and the loading function are stored in the memory space; A callback function setting module is configured to set a callback function based on the loading function, wherein the callback function is used to be called by the operating system itself to run the loading function in the target process without creating a thread when the operating system reaches a preset state.
8. The apparatus of claim 7, wherein, The loading function encapsulation module comprises: A first function segment construction unit is configured to construct a first function segment for saving a current operating system state; A second function segment construction unit is configured to construct a second function segment for allocating a stack space; A third function segment construction unit is configured to construct a third function segment for loading a dynamic link library based on an operating system callback mechanism, wherein the third function segment is run based on the stack space; A fourth function segment construction unit is configured to construct a fourth function segment for recycling the stack space; A fifth function segment construction unit is configured to construct a fifth function segment for restoring an operating system state according to the saved current operating system state; An encapsulation unit is configured to encapsulate the first function segment, the second function segment, the third function segment, the fourth function segment, and the fifth function segment to obtain a loading function.
9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement the dynamic link library injection method of claim 1.
10. A dynamic link library injection device, comprising: The device comprises a processor and a memory, and the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement the dynamic link library injection method of claim 1.