0

In the past recent years of mine, I have been doing a lot of DLL injection with a few indie games and MMORPGs. I fully understand how to do it, and how it works for allowing these games to work not as the developer's intend them to.

If I am able to compromise these games so easily and fast, what keeps me from doing it to the Windows itself in general?

  • In fact, it's happened before. The ZeroAccess trojan, would launch the real flash player with a hacked DLL, and when you gave it Admin rights (to install Flash Player), it entered the system. – a-- Mar 29 '14 at 18:31
  • 1
    ...because what's going on is that you're compromising your own system. If you read the Old/New Thing blog, the author calls it "being on the other side of an airtight hatchway". It's like asking what's preventing people from entering your house - all your friends would ask "yes, but you lock your doors, don't you?"; you can "break into" your own house trivially - you already have the key. Breaking into someone else's house is pretty difficult if, y'know, they never give you the key... – Clockwork-Muse Mar 29 '14 at 22:24
  • @Clockwork-Muse You really should post that as an answer, I would upvote it. – Scott Chamberlain Mar 31 '14 at 3:33
  • Because DLL Injection apply to a process, and Windows is an OS. You don't DLL inject an OS. What you can do though, is inject DLL in Windows processes, such as lsass.exe or explorer.exe. This is used by many malwares/viruses/worms. – ack__ Mar 31 '14 at 22:32
-1

Kernel security measures. I don't know a lot about the memory security model of Windows, because I don't use Windows and am not interested in it, but I would bet you anything that there are parts of memory that you are not allowed to modify, no matter what. Ever. Even as the administrator.

Why?

Here are three reasons I can think of off the top of my head:

  • Stopping you from accidentally corrupting some part of the system - in other words, it's a user experience thing
  • Protection against malware
  • DRM

That last one is a special motivator for Microsoft. Microsoft ships DRM products in Windows which content publishers rely on to "secure" their media (I put secure in quotes because DRM does a highly questionable job of that). Microsoft makes money off their DRM systems; therefore, they are financially motivated to keep their DRM systems robust (the more robust a DRM system is, the harder it is to break).

Now, DRM would be extremely easy to break if the user was able to load anything into their computer, anywhere, because they'd just load a DLL into the media application being targeted and dump the decrypted data to disk. Therefore*, the developers of the Windows kernel will have implemented memory protection, which prevents applications from modifying certain portions of memory. My guess is that at the very least the kernel will mark itself as protected memory (otherwise you would be able to circumvent memory protections on other parts of the system), along with DRM-protected content.

Okay. But how?

This is a simplification, but essentially, an operating system kernel is a bridge between software in hardware. Whenever a program wants to do anything remotely related to hardware - whether it be talking to a USB bus or accessing the disks or allocating memory - it is required to go through the kernel. Therefore, the kernel can include logic about what memory is "legal" to allocate or access and what isn't. And if an application tries to modify the address space of another application which happens to be loaded into protected memory, the modifying application will recieve an error from the kernel telling it that what it just tried to do isn't allowed.

*This is not the only reason to implement memory protection. Any operating system claiming to be secure but without memory protection was implemented either by idiots, incompetents, or more likely, both. I just chose to focus on the DRM aspect in this case.

  • why was this downvoted? it doesn't cover everything - fine. not a reason to downvote, simply don't upvote – strugee Apr 2 '14 at 6:33
4

...because what's going on is that you're compromising your own system. If you read the Old/New Thing blog, the author calls it "being on the other side of an airtight hatchway".

It's like asking what's preventing people from entering your house - all your friends would ask "yes, but you lock your doors, don't you?"; you can "break into" your own house trivially - you already have the key. Breaking into someone else's house is pretty difficult if, y'know, they never give you the key...

0

Nothing. The only problem you may encounter is getting the execution or the download. But that can be trivial at times.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy