How it Works: DLL Injection

a-foton » Blog Archive » How it Works: DLL Injection

a-foton » Blog Archive » How it Works: DLL Injection — Fri, 20 Jun 2008 21:09:01 GMT

PingBack from http://blog.a-foton.ru/2008/06/20/how-it-works-dll-injection/

re: How it Works: DLL Injection

molotov — Fri, 20 Jun 2008 23:37:00 GMT

Good write-up, Bob - Thanks!

Do you suspect the injection was related to malware?

>> I recently worked on an issue where the interaction of two threads in Winlogon led to a bugcheck. One thread was a Winlogon thread initializing GDI. The interesting thing about this scenario is how the other thread ended up in this process. <<

Wonder if you might care to indicate what the interaction was that led to the bugcheck?

re: How it Works: DLL Injection

Volodymyr Shcherbyna — Mon, 23 Jun 2008 15:36:08 GMT

Hello,

I suppose things get wrong because of "Address Space Randomization" feature introduced in Vista to prevent successful execution of "shell code" in case of stack/heap corruptions (addresses of API functions usually are static in shell code).

re: How it Works: DLL Injection

Volodymyr Shcherbyna — Tue, 24 Jun 2008 13:25:05 GMT

"Wonder if you might care to indicate what the interaction was that led to the bugcheck?"

To "molotov": calling function on improper address usually results in access violations or simular errors. This leads to termination of process in which the dll was loaded. Since the process is winlogon.exe, the system goes into reboot, because it is critical process.

Interesting Links – 6/24/2008

Matt Johnson's Technical Adventures — Tue, 24 Jun 2008 17:15:58 GMT

Ask the Directory Services Team : Custom Certificate Request in Windows Vista Microsoft Security Development

re: How it Works: DLL Injection

molotov — Tue, 24 Jun 2008 17:50:28 GMT

@Volodymyr - Yes, thanks - I am aware of that. I was curious for more details as to the specific interaction between the threads that caused the problem (one thread causing an access violation etc. would be enough to bring down winlogon and the system). The first thread is mentioned in the sentence "One thread was a Winlogon thread initializing GDI.", and then is not mentioned again. The rest of the analysis revolves around the injected thread.

Maybe I'm missing something...

re: How it Works: DLL Injection

calin_iaru — Fri, 05 Sep 2008 14:40:28 GMT

Typo:

Starting address. This is not in any module displayed by “!peb”

should be

"lm"