I am confused and would like to know the difference between DLL injection and DLL hooking? I am familiar with its use in malware and I know that key-loggers use it. I also know that SetWindowsHooKEX is used in DLL hooking.
-
1I do not believe it is a duplicate, but OP should delete their answer defending that, and instead make a defense in the comments/question. A DLL Hook is not the same thing as DLL hijacking, that seems clear to me.– GrayCommented Dec 9, 2014 at 15:14
Add a comment
|
1 Answer
Hooking uses an operating system feature to monitor events sent to the process, like low level keyboard and mouse messages. Applications can utilize a targeted or global hook in order to keylog (malevolent) or listen for keystrokes in order to perform value adding functionality such as executing macros or other hotkey functionality. (benevolent)
DLL injection is what it sounds like, a dynamic linked library is injected into the target process by forcing the process to load the DLL. Once loaded, the injected DLL can act sort of like an API that can be accessed externally from the process (think backdoor API), and can interact with the public internals of the process that would otherwise be impossible.
DLL injection is mostly use benevolently by software debuggers and accessibility software for the disabled. However it is also used for cheating in single-player videogames through things like cheat-engine and trainers.
A trainer utilizes both of these techniques. The application that is loaded (the trainer) hooks the target application and listens for keystrokes associated with hotkey functionality. Usually at the same time it will DLL inject the application with their backdoor API. The trainer then listens for keystrokes that are associated with hotkey functionality, and when that keystroke event is detected, executes the associated functionality through the backdoor API.
As far as security is concerned, you do not want any non-trusted software doing either of these. You should be very careful with who you trust, and that is why non-reputable trainers are so dangerous to install and use. Both of these techniques require elevated permissions from the OS, which gives them access to other high-level OS features that you would never want non-reputable software to have.
Keep in mind when using these applications can listen to everything when loaded. Just because they say they inject "ApplicationA" doesn't mean they aren't also injecting your web browsers and password managers as well.
Use at your own risk.
