🚀 go-pugleaf

"Mark Jacobs" <www.jacobsm.com/mjmsg.htm?Borland Newsgroup> wrote in
message news:465b45cb$1@newsgroups.borland.com...

> I need some information on how an application can raise an alert
> if another process on the system attempts to perform DLL code
> injection.

The only way I know of would be to install your own hook that
redirects the VirtualAllocEx(), LoadLibrary/Ex(), and/or
CreateRemoteThread() functions of every running process, such as with
madCodeHook (http://www.madshi.net), which incidently also has DLL
injection capabilities of its own implemented.  You can then detect
whenever those functions are called by any process you hook.

On NT-based systems at least, DLL injection is commonly done by
calling VirtualAllocEx() to create a block of memory in the context of
the target process, then filling that memory with the desired DLL
filename, and then calling CreateRemoteThread() to run a new thread in
the target process that calls LoadLibrary/Ex(), passing it the memory
block that was allocated.

So in theory, you could keep track of whenever VirtualAllocEx() is
used to allocate memory in a different process than the one calling
VirtualAllocEx(), and then detect when that same memory address is
being passed as a parameter to CreateRemoteThread(), as well as when
LoadLibrary/Ex() is being passed as the starting address of the new
thread procedure.

I am sure that there are other ways to inject a DLL into a process,
but this will get you started.


Gambit