2

I am confused. I would like to know if dll hijacking and dll injection are the same or are they different. I know that some malware use it to do malicious things.

thank you in advance

2

DLL Hijacking is when you abuse the library search order to gain execution in a process. Being able to write to the directory an executable resides in allows a malicious actor the ability to drop a dll with the same name as one the executable will request via LoadLibrary. When the executable attempts to load the expected library, they will instead load the malicious one.

  • A legitimateish use for DLL Hijacking could be to add functionality to a third party tool that doesn't directly support plugins.

  • The finer details are explained by MSDN in the LoadLibrary entry.

  • See also this SO Question

DLL Injection on the other hand is where a running process is manipulated to load a desired library. MSDN details a way to do so without directly touching the process, through SetWindowsHookEx. Another way is to open a process, write the desired library name into its memory space, and then create a thread in the process to call LoadLibrary using that name as the buffer. This second way is covered in a SO Question

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.