I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things.
thank you in advance
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
DLL Hijacking is when you abuse the library search order to gain execution in a process. Being able to write to the directory an executable resides in allows a malicious actor the ability to drop a dll with the same name as one the executable will request via LoadLibrary. When the executable attempts to load the expected library, they will instead load the malicious one.
A legitimateish use for DLL Hijacking could be to add functionality to a third party tool that doesn't directly support plugins.
The finer details are explained by MSDN in the LoadLibrary entry.
See also this SO Question
DLL Injection on the other hand is where a running process is manipulated to load a desired library. MSDN details a way to do so without directly touching the process, through SetWindowsHookEx. Another way is to open a process, write the desired library name into its memory space, and then create a thread in the process to call LoadLibrary using that name as the buffer. This second way is covered in a SO Question