1

Idk if this is asked before sorry

So I tried something with Process Hacker and Windbg but it couldn't help me The dll is injected using CreateRemoteThread, LoadLibrary i tried looking through files but im a newbie so i didn't got so much experience. What way would you guys prefer to export a dll of process memory?

Improve this question
5
  • Do you mean "export" as in save the content of the loaded DLL (using the original loaded DLL files would be easier) or do you mean "export" like unload/remove the loaded library?
    – Robert
    May 1 at 17:44
  • saving it, is it possible?
    – Kreapet
    May 2 at 15:21
  • Why? You can use Sysinternals ProcessMonitor to check which libraries are loaded and the simply copy the DLL file from file-system. No need to extract/export anything from a running process.
    – Robert
    May 2 at 15:52
  • I tried it but the dll gets deleted after injection.
    – Kreapet
    May 2 at 20:02
  • If you know the file name or the directory you can create a program that waits for file-system modifications and automatically opens and locks all created files in a folder, or if possible hook the process the dll is injected into overwrite Load library method (e.g. using Frida) and let it wait a few seconds, then you have plenty of time to copy the file.
    – Robert
    May 2 at 20:27

1 Answer 1

Reset to default
0

If the library is indeed loaded using LoadLibrary, it must exist on disk. You can, for example, check the list of modules using Process Explorer or similar and look for it on disk, or catch the load event in the debugger - the file should be available at that point even if it’s deleted afterwards.

Improve this answer
3
  • the file isn't shown in modules list i will test catching the load event in the debugger
    – Kreapet
    May 2 at 20:15
  • Putting breakpoint on LoadLibrary is another option
    – Igor Skochinsky ♦
    May 2 at 20:16
  • Just a thought, how do you know the DLL remains resident after being loaded? In theory it'd also be possible for a DLL to get loaded, do whatever it wants to do and then get unloaded. But Igor's suggestions are probably the way to go for starters.
    – 0xC0000022L ♦
    May 3 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.