Re: DLL Injection from kernel-land

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Arnaud VALLAT wrote:
Hello,

yep it works like a charm. But I would like to remove jumps. It's
working like this:
1- program is waiting for event
2- driver receives notification and sets an event
3- program catches event and asks driver information about process
4- program injects DLL in process
5- DLL walks through PE and patches function addresses

And I thought it would be better if all of this were done directly from
the driver. You see ?

Do the same thing you're doing in user-mode:

1. in kernel, patch the system service table to intercept
CreateProcess.
2. record whether process was created suspended or not.
3. create the process suspended anyway.
4. inject new virtual memory into process
5. write in virtual memory some code that loads the DLL of interest
6. redfine entry point of your function of choice to call code to load
DLL (tricky)
7. Get rid of VM to keep process "clean"

Of course, Patch Guard, will keep this from working.

Personally, I

.

Relevant Pages

  • Re: FTDI USB Serial Drivers
    ... The DLL accesses the inf for setup ... from the FTDI driver readme: ... Notes on INF files ... particular VID and PID requires access to a registry editor which (unlike ...
    (microsoft.public.windowsce.platbuilder)
  • Re: FTDI USB Serial Drivers
    ... The DLL accesses the inf for setup ... from the FTDI driver readme: ... Notes on INF files ... particular VID and PID requires access to a registry editor which (unlike ...
    (microsoft.public.windowsce.platbuilder)
  • Re: Reprise: Pended IOCtrl + LoadLibrary == Deadlock?
    ... Is your driver handle open in FILE_FLAG_OVERLAPPED mode? ... > happen at startup and shutdown. ... The dll is loaded and instructed by the ... >>> Devstudio and windbg both use int 3 for breakpoints. ...
    (microsoft.public.development.device.drivers)
  • Re: Accessing peripherals from a managed application
    ... File Type: DLL ... to access to the driver from a managed application. ... Somehow figure out the headers contained in coredll.dll ... Call on the imported functions to access the hardware. ...
    (microsoft.public.windowsce.app.development)
  • Re: Do you tell me how to generate the usbser.dll for PB6?
    ... I am going to find a way to generate the dll from lib file. ... Please note that the 1118/206 is the USB device's PID/VID. ... then it want to load the dll file in the ... // Attempt to load client driver based on registry settings ...
    (microsoft.public.windowsce.platbuilder)