I know a techinique is called: Process Replacement , I have searched but could not find any article about "DLL Replacement", in which malicious programs can replace a legal DLL (eg. a third party DLL) with a malicious DLL.

How does this work and are there any other techniques to do it?

  • 4
    What you are talking about is DLL Hijacking. – 0xec Aug 12 '14 at 6:10
  • Nope, dll will be replaced in memory when it has been loaded in to process. – aoe Aug 12 '14 at 7:16
  • Replacing a DLL is over complicated task which can be easily simplified by other methods. Could you tell us that your actual end goal is for? I may able to offer you a more effective and simple solution. – Paul Aug 12 '14 at 14:10
  • When a DLL is loaded in memory in one process, and another process loads the same DLL, windows will map the (read only) code segment of the DLL into both processes. If you find a way to alter your "copy" of the code segment, this alteration would affect the other process as well; you could use this to cause the other process (which might have higher privileges) to execute your code. However, i wouldn't know how to turn this into an exploit; once you have the rights to modify segment descriptors, there's not much left that the other process can do but you can't. – Guntram Blohm Aug 12 '14 at 14:28
  • 1
    @Guntram, to alter your copy would require access to the section object. A simple VirtualProtect() will trigger a copy-on-write, and the remote process will not be affected. – peter ferrie Aug 12 '14 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.