3

This question already has an answer here:

I'm trying to figure out how can I detect a process for being injected with a dll. I found this thread but I couldn't figure out a simple way out of it.

I want to clarify my intention: given a pid - I want to return an answer if that process was injected with a dll or not.

I thought of dumping all the dependencies of a process and then compare it to the running process - the problem is that the dependencies load their own dlls...

I heard that Anti viruses compares check sums or something like that - but couldn't understand how exactly.

marked as duplicate by de6f, perror, TechLord, Paweł Łukasik, kn0x Apr 2 '18 at 20:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

You can recursively follow dependencies to figure out which DLLs were loaded directly by the Windows loader. You may create an imported modules list. Fill imported module list with every module you find in the main PE's import table. Then recursively parse the import tables of all DLLs you found that way. You'll have a list with all DLLs imported. Then, just compare it to the list of loaded modules.

Discrepancies you find might be either injected DLLs or dynamically loaded DLLs.

Identifying dynamically loaded DLLs might be a bit more challenging, but one way to identify those is to disassemble the executable and search for calls to LoadLibrary, LoadLibraryEx etc.

  • 1
    That wouldn't detect DLLs that have been either removed from the list of loaded modules or even loaded manually though. – Dillinur Jun 9 '17 at 19:20
  • Kinda felt like both are out of scope tbh – NirIzr Jun 9 '17 at 19:22
  • Add a compare to the path too, and you will be fine. You know what your app uses. So, you can detect injected DLLs, through one way or another. If for third-party apps, it is much more difficult, but also possible. – dyasta Jun 19 '17 at 13:10
  • any DLL can be renamed and replaced at any point, so as I wrote in the original thread, there are things that you can try, but they might not work. The short answer is that you really can't be certain that you don't have an active injection. – peter ferrie Jun 19 '17 at 18:10
-1

You can use Win32APIs: Loop over the process memory and find regions which have RWX permissions. This may NOT always work (as some malwares change back the permission to RX before executing the code) so play with it as you like.

#include "stdafx.h"
#include "stdio.h"
#include <iostream>
#include "Windows.h"



/*The idea is to go region by region over the memory of the process and look for regions with PAGE_EXECUTE_READWRITE
which is one of the parameter values passed at VirtualAllocEx during the injection */
int main(int argc, char *argv[])
{
    if (argc != 2) {
        std::cout << "Usage: " << argv[0] << " PID" ;
        return 1;
    }
    MEMORY_BASIC_INFORMATION  mbi = { 0 };
    SYSTEM_INFO si;
    LPVOID lpMem = 0;
    int i = 0;
    GetSystemInfo(&si);
    HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)atoi(argv[1]));
    while (lpMem < si.lpMaximumApplicationAddress) {
        VirtualQueryEx(h, lpMem, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
        if (mbi.AllocationProtect == PAGE_EXECUTE_READWRITE) {
            printf("Injection information:\n");
            printf("Base Address: %p \n", mbi.BaseAddress);
            printf("Allocation Base: %p \n", mbi.AllocationBase);
            printf("Allocation Protect: %x \n", mbi.AllocationProtect);
            printf("Region size: %zu \n", mbi.RegionSize);
            printf("State: %x \n", mbi.State);
            printf("Protect: %x \n", mbi.Protect);
            printf("Type: %x \n\n", mbi.Type);
            }
            lpMem = (LPVOID)((DWORD)mbi.BaseAddress + (DWORD)mbi.RegionSize); /* increment lpMem to next region of memory */


    }
    system("PAUSE");
}

Not the answer you're looking for? Browse other questions tagged or ask your own question.