1

Idk if this is asked before sorry

So I tried something with Process Hacker and Windbg but it couldn't help me The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files but im a newbie so i didn't got so much experience. What way would you guys prefer to export a dll of process memory?

5
  • Do you mean "export" as in save the content of the loaded DLL (using the original loaded DLL files would be easier) or do you mean "export" like unload/remove the loaded library?
    – Robert
    May 1, 2022 at 17:44
  • saving it, is it possible?
    – Kreapet
    May 2, 2022 at 15:21
  • Why? You can use Sysinternals ProcessMonitor to check which libraries are loaded and the simply copy the DLL file from file-system. No need to extract/export anything from a running process.
    – Robert
    May 2, 2022 at 15:52
  • I tried it but the dll gets deleted after injection.
    – Kreapet
    May 2, 2022 at 20:02
  • If you know the file name or the directory you can create a program that waits for file-system modifications and automatically opens and locks all created files in a folder, or if possible hook the process the dll is injected into overwrite Load library method (e.g. using Frida) and let it wait a few seconds, then you have plenty of time to copy the file.
    – Robert
    May 2, 2022 at 20:27

1 Answer 1

0

If the library is indeed loaded using LoadLibrary, it must exist on disk. You can, for example, check the list of modules using Process Explorer or similar and look for it on disk, or catch the load event in the debugger - the file should be available at that point even if it’s deleted afterwards.

3
  • the file isn't shown in modules list i will test catching the load event in the debugger
    – Kreapet
    May 2, 2022 at 20:15
  • Putting breakpoint on LoadLibrary is another option
    – Igor Skochinsky
    May 2, 2022 at 20:16
  • Just a thought, how do you know the DLL remains resident after being loaded? In theory it'd also be possible for a DLL to get loaded, do whatever it wants to do and then get unloaded. But Igor's suggestions are probably the way to go for starters.
    – 0xC0000022L
    May 3, 2022 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.