DLL injection process control method and device, equipment and storage medium
By judging whether the target DLL file belongs to the target process's DLL file scope, it determines whether to block the loading of the DLL file, which solves the problem that the existing DLL injection method cannot independently control process injection, and realizes the controllability of the DLL injection behavior and Improved safety.
Patent Information
- Application Number
- CN202411426988.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-14
- Publication Date
- 2025-02-11
AI Technical Summary
The existing DLL injection method cannot independently choose which processes to release not to inject, resulting in software compatibility problems with high security requirements. The injection method is monotonous, which is prone to omissions and cracking, reducing security.
By receiving the request of the target process to load the target DLL file, we determine whether the target DLL file belongs to the target process's DLL file scope to filter, and determine whether the DLL file is blocked based on the judgment results, thereby controlling whether the DLL is injected into the process.
It realizes controllability of DLL injection behavior, solves the compatibility problems of various DLL injection methods, and improves security.
Smart Images
Figure CN119415171A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a control method, device, equipment and storage medium for a DLL injection process. Background Art
[0002] In order to inject DLL (Dynamic Link Library) with various monitoring functions into each process that needs to be controlled, and to reduce the possibility that DLL injection cannot be completed due to failure of a certain injection method, invalidity on a certain software, or conflicts on a certain software, it is often necessary to use several different DLL injection methods at the same time, such as using global message hooks, registry injection methods, and disguised input methods.
[0003] Among these different injection methods, some are controllable and can choose which processes to inject into, while others are pushed to all processes, such as the global message hook method to inject DLL into all processes with windows, and the registry injection method to inject DLL into all processes that load user32.dll. The caller who uses these two injection methods to inject DLL cannot actively choose which processes to release and not inject into each other. For some software with higher security requirements, third-party components are not allowed to be injected into their own processes, which will cause compatibility issues such as the software refusing to run. In this case, it is often necessary to choose to abandon this DLL injection method that cannot autonomously control which processes to release in the current environment, which will make the DLL injection method in this environment monotonous, prone to omissions and cracking, and reduce security.
[0004] It can be seen that the existing technology only has compatibility issues with individual software and is applicable to most software, but the solution of completely disabling this method of processing DLL injection is adopted, which is obviously an overreaction and will make the injection technology monotonous, prone to omissions and cracking, and reduce security. Summary of the invention
[0005] The purpose of this application is to provide a control method, device, electronic device and storage medium for a DLL injection process.
[0006] In a first aspect, an embodiment of the present application provides a method for controlling a DLL injection process, including:
[0007] Receive a request from the target process to load the target DLL file;
[0008] Determine whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, and obtain a determination result;
[0009] Determine whether to block the target process from loading the target DLL file according to the judgment result.
[0010] In a possible implementation, determining whether to block the target process from loading the target DLL file according to the judgment result includes:
[0011] If the judgment result is that the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, then the process is blocked from loading the target DLL file;
[0012] If the judgment result is that the target DLL file does not belong to the range of DLL files that need to be filtered corresponding to the target process, the process is allowed to load the target DLL file.
[0013] In a possible implementation, before receiving a request from a target process to load a target DLL file, the method further includes:
[0014] Get the correspondence between the process and the range of DLL files to be filtered from the system registry;
[0015] After receiving the request from the target process to load the target DLL file, the method further includes:
[0016] From the correspondence between the process and the range of the DLL file to be filtered, the range of the DLL file to be filtered corresponding to the target process is obtained.
[0017] In a possible implementation, the method further includes:
[0018] Receive the correspondence between the updated process sent by the server and the range of DLL files to be filtered;
[0019] The updated correspondence between the process and the range of DLL files to be filtered replaces the current correspondence between the process and the range of DLL files to be filtered in the system registry.
[0020] In a second aspect, an embodiment of the present application provides a control device for a DLL injection process, including:
[0021] A receiving module, used for receiving a request from a target process to load a target DLL file;
[0022] A judgment module, used to judge whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, and obtain a judgment result;
[0023] A determination module is used to determine whether to block the target process from loading the target DLL file according to the judgment result.
[0024] In a possible implementation, the determining module is specifically configured to:
[0025] If the judgment result is that the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, then the process is blocked from loading the target DLL file;
[0026] If the judgment result is that the target DLL file does not belong to the range of DLL files that need to be filtered corresponding to the target process, the process is allowed to load the target DLL file.
[0027] In a possible implementation, the judgment module is further used to:
[0028] Before the receiving module receives a request from a target process to load a target DLL file, a corresponding relationship between the process and a range of DLL files to be filtered is obtained from a system registry;
[0029] From the correspondence between the process and the range of the DLL file to be filtered, the range of the DLL file to be filtered corresponding to the target process is obtained.
[0030] In a possible implementation manner, the device further includes:
[0031] The update module is used to receive the correspondence between the updated process and the range of DLL files to be filtered sent by the server; and replace the correspondence between the current process and the range of DLL files to be filtered in the system registry with the correspondence between the updated process and the range of DLL files to be filtered.
[0032] In a third aspect, the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect.
[0033] In a fourth aspect, the present application provides a computer-readable storage medium having computer-readable instructions stored thereon, wherein the computer-readable instructions can be executed by a processor to implement the method as described in the first aspect.
[0034] Compared with the prior art, the control method of the DLL injection process provided by the present application receives a request from the target process to load the target DLL file; determines whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, and obtains a judgment result; determines whether to block the target process from loading the target DLL file based on the judgment result. It can be seen that the present application can determine whether the target DLL file is a DLL file to be filtered when the process loads the target DLL file, thereby further determining whether to block the process from loading the target DLL file, thereby being able to control whether the DLL is injected into the process, achieving controllability of DLL injection behavior, solving the compatibility problem of multiple DLL injection methods, and improving security. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:
[0036] Figure 1 A flow chart of a method for controlling a DLL injection process provided by an embodiment of the present application is shown;
[0037] Figure 2 A flowchart showing the filtering policy delivery process provided in an embodiment of the present application is shown;
[0038] Figure 3 A flowchart showing a process of blocking DLL injection by a file filter driver provided in an embodiment of the present application is shown;
[0039] Figure 4 A schematic diagram of a control device for a DLL injection process provided by an embodiment of the present application is shown;
[0040] Figure 5 A schematic diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION
[0041] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.
[0042] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.
[0043] In addition, the terms "first" and "second" etc. are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.
[0044] Please refer to Figure 1 , Figure 1This is a flow chart of a method for controlling a DLL injection process provided by an embodiment of the present application, comprising the following steps S101 to S103:
[0045] S101, receiving a request from a target process to load a target DLL file;
[0046] Specifically, before step S101, the method further includes: obtaining a corresponding relationship between a process and a range of DLL files to be filtered from a system registry.
[0047] The system here refers to the operating system on the terminal. The target process is the process of the third-party software running on the terminal. The target DLL file can be a monitoring function DLL. If the target process successfully loads the target DLL file, the target DLL file is successfully injected into the target process.
[0048] Specifically, after step S101, the method further includes: acquiring the DLL file range to be filtered corresponding to the target process from the corresponding relationship between the process and the DLL file range to be filtered.
[0049] S102, determining whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, and obtaining a determination result;
[0050] S103: Determine whether to block the target process from loading the target DLL file according to the judgment result.
[0051] Specifically, the above step S103 includes:
[0052] If the judgment result is that the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, then the process is blocked from loading the target DLL file;
[0053] If the judgment result is that the target DLL file does not belong to the range of DLL files that need to be filtered corresponding to the target process, the process is allowed to load the target DLL file.
[0054] In some embodiments, the control method of the DLL injection process may further include the following steps:
[0055] Receive the correspondence between the updated process sent by the server and the range of DLL files to be filtered;
[0056] The updated correspondence between the process and the range of DLL files to be filtered replaces the current correspondence between the process and the range of DLL files to be filtered in the system registry.
[0057] In this embodiment, the correspondence between the processes and the range of DLL files to be filtered stored in the terminal registry can be updated by the server to further meet user needs.
[0058] The present application is further introduced below with reference to a specific embodiment.
[0059] A policy configuration module and a file filtering driver can be set in the operating system. The policy configuration module obtains the correspondence between the process sent by the server and the range of DLL files to be filtered (hereinafter referred to as filtering policy), pushes it to the file filtering driver, and blocks the corresponding process from loading the specified DLL when the file filtering driver encounters it.
[0060] like Figure 2 As shown in the figure, the filtering policy delivery process is as follows:
[0061] Step 1: Configure filtering policies on the server. Each filtering policy is mainly based on pairing the process with the DLL file to be filtered and stored in the database.
[0062] Step 2: The policy synchronization module of the server works together with the policy configuration module of the terminal to update the filtering policy to the terminal.
[0063] Step 3: The policy configuration module writes the filtering policy into the terminal database and pushes another copy to the file filtering driver. After receiving the filtering policy, the file filtering driver writes a copy into the registry for storage.
[0064] like Figure 3 As shown, the file filtering driver blocks the DLL injection process:
[0065] Step 1: When the file filter driver starts, the filter policy saved in the registry is loaded and used before the policy configuration module re-issues the filter policy.
[0066] Step 2: The file filter driver registers a processing callback to monitor file open requests with the system kernel. When the application layer software requests to open a file, the system will call the corresponding registered processing function PreCreateFilter.
[0067] Step 3: The terminal uses SetWindowsHook or SetWindowsHookEx to start global message hook injection. The system will allow the process with window message processing to load and initialize the monitoring function DLL.
[0068] Step 4: When the third-party software receives the message to load and initialize the monitoring function DLL, it will try to load the corresponding monitoring function DLL. When trying to open the DLL file, it will request the system bottom layer to open the handle of the file. The system calls the registered processing function PreCreateFilter for processing. In PreCreateFilter, it is determined whether the permissions specified in the request include read and execute permissions. If they are included and the file requested to be opened matches the process and filtering policy that initiated the request, the request will not be passed to the bottom layer of the system and will be directly returned as no permission. The software will not be able to load the monitoring function DLL and will not affect the normal operation of the software.
[0069] The control method of the DLL injection process provided by the embodiment of the present application has the following beneficial effects:
[0070] This application receives a request from a target process to load a target DLL file, determines whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, obtains a judgment result, and determines whether to block the target process from loading the target DLL file based on the judgment result. It can be seen that this application can determine whether the target DLL file is a DLL file to be filtered when the process loads the target DLL file, thereby further determining whether to block the process from loading the target DLL file, thereby being able to control whether the DLL is injected into the process, achieving controllability of DLL injection behavior, solving the compatibility problem of multiple DLL injection methods, and improving security.
[0071] In the above embodiment, a control method for a DLL injection process is provided. Correspondingly, the present application also provides a control device for a DLL injection process. The control device for a DLL injection process provided in the embodiment of the present application can implement the control method for the DLL injection process. The control device for the DLL injection process can be implemented by software, hardware, or a combination of software and hardware. For example, the control device for the DLL injection process can include integrated or separate functional modules or units to execute the corresponding steps in the above methods. Please refer to Figure 4 As shown, the control device 10 of the DLL injection process of the present application includes:
[0072] A receiving module 101 is used to receive a request from a target process to load a target DLL file;
[0073] A judgment module 102 is used to judge whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, and obtain a judgment result;
[0074] The determination module 103 is used to determine whether to block the target process from loading the target DLL file according to the determination result.
[0075] In a possible implementation, the determining module 103 is specifically configured to:
[0076] If the judgment result is that the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, then the process is blocked from loading the target DLL file;
[0077] If the judgment result is that the target DLL file does not belong to the range of DLL files that need to be filtered corresponding to the target process, the process is allowed to load the target DLL file.
[0078] In a possible implementation, the determining module 102 is further configured to:
[0079] Before the receiving module receives a request from a target process to load a target DLL file, a corresponding relationship between the process and a range of DLL files to be filtered is obtained from a system registry;
[0080] From the correspondence between the process and the range of the DLL file to be filtered, the range of the DLL file to be filtered corresponding to the target process is obtained.
[0081] In a possible implementation manner, the device further includes:
[0082] The update module is used to receive the correspondence between the updated process and the range of DLL files to be filtered sent by the server; and replace the correspondence between the current process and the range of DLL files to be filtered in the system registry with the correspondence between the updated process and the range of DLL files to be filtered.
[0083] The control device for the DLL injection process provided in the embodiment of the present application and the control method for the DLL injection process provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.
[0084] An embodiment of the present application also provides an electronic device corresponding to the method provided in the aforementioned embodiment, and the electronic device may be an electronic device for a client, such as a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the control method of the above-mentioned DLL injection process.
[0085] Please refer to Figure 5 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 5As shown, the electronic device 20 includes: a processor 200, a memory 201, a bus 202 and a communication interface 203, and the processor 200, the communication interface 203 and the memory 201 are connected via the bus 202; the memory 201 stores a computer program that can be run on the processor 200, and when the processor 200 runs the computer program, the control method of the DLL injection process provided in any of the aforementioned embodiments of the present application is executed.
[0086] The memory 201 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 203 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.
[0087] The bus 202 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 201 is used to store programs, and the processor 200 executes the programs after receiving the execution instruction. The control method of the DLL injection process disclosed in any implementation of the embodiment of the present application may be applied to the processor 200, or implemented by the processor 200.
[0088] The processor 200 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 200. The above processor 200 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a readily available programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 201, and the processor 200 reads the information in the memory 201 and completes the steps of the above method in combination with its hardware.
[0089] The electronic device provided in the embodiment of the present application and the control method of the DLL injection process provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented therein.
[0090] An embodiment of the present application also provides a computer-readable storage medium corresponding to the control method of the DLL injection process provided in the aforementioned embodiment, on which a computer program (i.e., a program product) is stored. When the computer program is executed by a processor, it will execute the control method of the DLL injection process provided in any of the aforementioned embodiments.
[0091] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.
[0092] The computer-readable storage medium provided in the above-mentioned embodiment of the present application and the control method of the DLL injection process provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the method adopted, run or implemented by the application program stored therein.
[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application, and they should all be included in the scope of the claims and specification of the present application.
Claims
1. A method for controlling a DLL injection process, characterized in that: include: Receive a request from the target process to load the target DLL file; Determine whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, and obtain a determination result; Determine whether to block the target process from loading the target DLL file according to the judgment result.
2. The method according to claim 1, characterized in that The determining, according to the judgment result, whether to block the target process from loading the target DLL file comprises: If the judgment result is that the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, then the process is blocked from loading the target DLL file; If the judgment result is that the target DLL file does not belong to the range of DLL files that need to be filtered corresponding to the target process, the process is allowed to load the target DLL file.
3. The method according to claim 1, characterized in that Before receiving the request of the target process to load the target DLL file, the method further includes: Get the correspondence between the process and the range of DLL files to be filtered from the system registry; After receiving the request from the target process to load the target DLL file, the method further includes: From the correspondence between the process and the range of the DLL file to be filtered, the range of the DLL file to be filtered corresponding to the target process is obtained.
4. The method according to claim 3, characterized in that The method further comprises: Receive the correspondence between the updated process sent by the server and the range of DLL files to be filtered; The updated correspondence between the process and the range of DLL files to be filtered replaces the current correspondence between the process and the range of DLL files to be filtered in the system registry.
5. A control device for a DLL injection process, characterized in that: include: A receiving module, used for receiving a request from a target process to load a target DLL file; A judgment module, used to judge whether the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, and obtain a judgment result; A determination module is used to determine whether to block the target process from loading the target DLL file according to the judgment result.
6. The device according to claim 5, characterized in that The determination module is specifically used for: If the judgment result is that the target DLL file belongs to the range of DLL files to be filtered corresponding to the target process, then the process is blocked from loading the target DLL file; If the judgment result is that the target DLL file does not belong to the range of DLL files that need to be filtered corresponding to the target process, the process is allowed to load the target DLL file.
7. The device according to claim 5, characterized in that The judging module is also used for: Before the receiving module receives a request from a target process to load a target DLL file, a corresponding relationship between the process and a range of DLL files to be filtered is obtained from a system registry; From the correspondence between the process and the range of the DLL file to be filtered, the range of the DLL file to be filtered corresponding to the target process is obtained.
8. The device according to claim 7, characterized in that The device also includes: The update module is used to receive the correspondence between the updated process and the range of DLL files to be filtered sent by the server; and replace the correspondence between the current process and the range of DLL files to be filtered in the system registry with the correspondence between the updated process and the range of DLL files to be filtered.
9. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 4 when executing the computer program.
10. A computer-readable storage medium, characterized in that: Computer-readable instructions are stored thereon, and the computer-readable instructions can be executed by a processor to implement the method according to any one of claims 1 to 4.