Selective Library Injection via Temporary Import Dependency Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for injecting dynamic libraries into target processes are limited in flexibility and control, as they often require modifications to existing libraries and may interfere with conventional loading mechanisms, lacking selective and secure injection capabilities based on process attributes and environments.
Innovation Solution
An injection driver is executed within the target process to modify the import dependency data of a marker library, allowing an injection library to be included as a dependency, enabling selective and secure library injection based on processor architecture and runtime version, with the ability to revert changes after loading, ensuring minimal disruption and increased control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If dynamic libraries are injected into target processes using conventional techniques, then library injection capability is achieved, but flexibility and control are limited and existing libraries must be modified
Solution Approach 1:
The injection driver modifies the import dependency data of the marker library in advance, before the marker library is loaded and executed. This preliminary modification allows the injection library to be automatically loaded and executed before the marker library, enabling flexible control without requiring modifications to existing libraries on disk. The import dependency data is temporarily altered to include the injection library as a dependency, and then reverted after the injection library is loaded.
2Ease of operation
If library injection is performed before marker library execution, then control and flexibility are enhanced, but the loading mechanism is interfered with
Solution Approach 1:
The injection driver acts as an intermediary that temporarily modifies the import dependency data to enable injection library loading. This intermediary modification is carefully managed by detecting when the marker library is loaded, modifying the import dependency data at that moment, and then reverting the changes after the injection library is successfully loaded. This ensures the conventional loading mechanism remains intact while enabling controlled injection timing.
3Adaptability or versatility
If import dependency data is modified to include injection library, then selective injection based on process attributes is enabled, but the modification process becomes complex
Solution Approach 1:
The injection driver leverages the existing marker library loading mechanism to achieve selective injection. By modifying the import dependency data of the marker library, the system utilizes the marker library's own loading process to automatically load and execute the injection library. This self-service approach eliminates the need for complex custom loading mechanisms, as the marker library's existing loading logic naturally handles the injection library through the modified import dependency data.
Data Source
AI summary
A lock may be acquired on a virtual memory of a target process, where the virtual memory of the target process may include import dependency data of a marker library. An injection driver may be executed within the context of the target process when the marker library is loaded by the target process, where executing the injection driver within the context of the target process may enable the injection driver to modify virtual memory tables within the target process. The import dependency data of the marker library may be modified by the injection driver to include an injection library as a dependency of the marker library. After the modified import dependency data is used to load the injection library into the target process, the modified import dependency data may be reverted to an original state.