DLL Injection via Suspend Mode Process Creation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DLL injection techniques often conflict with each other and are unstable, with varying injection times depending on the operating environment and time, leading to potential failures.
Innovation Solution
A computing device and method that execute a target process as a child process in suspend mode, allowing for stable DLL injection by inserting code into a memory region and restoring the process for execution, while preventing conflicts with other injection techniques through system privilege management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DLL injection techniques are applied to a process, then DLL injection can be performed, but conflicts occur between multiple injection techniques and stability is reduced
Solution Approach 1:
The patent applies preliminary action by creating the target process in suspend mode before injecting the DLL. This allows the injection to occur at a predetermined, controlled moment when the process is still suspended, ensuring that no other injection techniques can interfere. The process is created with CreateProcess suspended, then the DLL is injected into this suspended process, and finally the process is resumed. This timing control eliminates conflicts between multiple injection techniques.
Solution Approach 2:
The patent uses the suspend/resume mechanism as an intermediary state. By placing the target process in a suspended state during the injection operation, it creates an intermediate condition that isolates the injection process from other concurrent operations. This intermediary state ensures that the DLL injection occurs in a controlled environment without interference from other processes or injection techniques.
2Ease of manufacture
If DLL injection is performed on a running process, then injection can be executed, but injection time varies depending on operating environment and time
Solution Approach 1:
The patent eliminates timing variability by performing the injection action immediately upon process creation, while the process is still in suspend mode. This preliminary action occurs at a fixed, deterministic point in the process lifecycle, before any environmental factors or other operations can cause timing variations. The injection happens as part of the process creation sequence, ensuring consistent timing across different operating environments.
3Adaptability or versatility
If multiple DLL injection techniques are simultaneously applied to the same process, then comprehensive coverage is achieved, but conflicts occur and stability is reduced
Solution Approach 1:
The patent extracts the target process from the general process pool by creating it in a special suspend mode specifically for injection purposes. This extracted state isolates the injection target from other processes that might be subjected to different injection techniques simultaneously, eliminating conflicts while maintaining the ability to apply various injection methods if needed.
Data Source
AI summary
Provided are a computing device provided with a DLL injection function and a DLL injection method. When receiving from an operating system notification of whether a target process corresponding to a program ordered by a user to be executed is created, a process creation module of an injection program executes a launcher process to create the target process as a child process of the launcher process and sets the target process to a suspend mode. A code insertion module receives allocation of a memory region where the target process is stacked, using a process handle of the target process, to insert a code for executing a DLL file to be injected into the target process. A restoration module cancels the suspend mode of the target process to allow the target process to be executed. According to the present invention, it is possible to stably perform DLL injection without confliction with another DLL injection technique by inserting a DLL executable code into the memory region of the target process which is created in the suspend mode.