3

I'm trying to figure out how can I detect a process for being injected with a dll. I found this thread but I couldn't figure out a simple way out of it.

I want to clarify my intention: given a pid - I want to return an answer if that process was injected with a dll or not.

I thought of dumping all the dependencies of a process and then compare it to the running process - the problem is that the dependencies load their own dlls...

I heard that Anti viruses compares check sums or something like that - but couldn't understand how exactly.

Improve this question
0

1 Answer 1

Reset to default
1

You can recursively follow dependencies to figure out which DLLs were loaded directly by the Windows loader. You may create an imported modules list. Fill imported module list with every module you find in the main PE's import table. Then recursively parse the import tables of all DLLs you found that way. You'll have a list with all DLLs imported. Then, just compare it to the list of loaded modules.

Discrepancies you find might be either injected DLLs or dynamically loaded DLLs.

Identifying dynamically loaded DLLs might be a bit more challenging, but one way to identify those is to disassemble the executable and search for calls to LoadLibrary, LoadLibraryEx etc.

Improve this answer
4
  • 1
    That wouldn't detect DLLs that have been either removed from the list of loaded modules or even loaded manually though.
    – user2823000
    Jun 9, 2017 at 19:20
  • Kinda felt like both are out of scope tbh
    – NirIzr
    Jun 9, 2017 at 19:22
  • Add a compare to the path too, and you will be fine. You know what your app uses. So, you can detect injected DLLs, through one way or another. If for third-party apps, it is much more difficult, but also possible.
    – dyasta
    Jun 19, 2017 at 13:10
  • any DLL can be renamed and replaced at any point, so as I wrote in the original thread, there are things that you can try, but they might not work. The short answer is that you really can't be certain that you don't have an active injection.
    – peter ferrie
    Jun 19, 2017 at 18:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.