2

I'm currently researching memory injection attacks on games in Windows 7/10.

After reviewing several threads on this topic, there's a few questions which are still unclear.

  1. DLL injection can be easily detected by using introspection. Even if you patch and sign an existing DLL, the SHA1 will mismatch and cause red flags, assuming the game client has detection for all this. Correct?

  2. Memory injection can be used to inject malicious code, however this can apparently only be achieved by using a signed kernel module as the memory space is protected from being read/written by other processes. Correct?

  3. If a kernel module is used to inject into a processes memory, is the process able to detect this? For example, lets say there's a string in memory which points to a disk path (/conf/something.cnf), if that was overwritten with a string with the exact same length, would the process be able to detect that memory was overwritten?

  • What platform are you talking about? – Neil Smithline Sep 27 '15 at 21:05
  • Windows 7 and Windows 10. Sorry I should have made this clear. – sleepycal Sep 27 '15 at 21:09
2

Answering in reverse order, because your later questions are predicated on inaccurate assumptions in your earlier ones:

3: Not if the injection code is sneaky enough. In theory, a process can, of course, scan its own address space and detect stuff that doesn't belong. That procedure that does the scanning needs to be in the process somewhere, though, and in practice you can just edit it out when doing your injections.

2: Incorrect. Any process can be debugged by another process running with the same security token as the debuggee, or with a superset of the token's access (that is, a sandboxed process under user A can be debugged by a non-sandboxed process under the same user), or by any process with elevated privilege (SeDebugPrivilege, which is normally only Administrators but could be other processes). See, for example, WriteProcessMemory. If you want to make the memory executable, you'll probably need to have used/use VirtualAllocEx/VirtualProtectEx. If you then want to start a thread (in the target process) executing on your injected memory, see CreateRemoteThread.

1: You're confusing DLL injection and something else, probably DLL squatting (which doesn't seem to be a well-known term, but it what I use and have heard used for when you place your own copy of an expected DLL further up the load path - for example, in the program's own directory - than the real version). DLL injection (where the process did not expect to load that DLL) is carried out in a number of ways, commonly using memory injection as above (inject the name of the DLL, use CreateRemoteThread to start a thread that calls LoadLibrary in the target process with the injected DLL name as the parameter). That DLL could then, of course, edit the process to do things like disable or bypass any introspection code that the DLL's author knew about.

  • This makes a lot more sense now, thank you for the clarification! – sleepycal Sep 27 '15 at 22:11
  • 2
    Another term for dll squatting is binary planting – wireghoul Sep 28 '15 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.