DLL/PROCESS INJECTION WRITEUP
By Viktory.

--WHAT ARE DLLS?--
You have probably seen a lot of .DLL files in the directory of your programs. But what are they?
DLLs, or Dynamic-Link Libraries, are basically libraries for a program where functions can be called and have it loaded into the memory.


--WHY USE DLLS?--
The basic idea was that the developer doesn't have to rewrite common functions. All that has to be done is have the program call a specific function from the dll.


--WHAT IS DLL INJECTION?--
Basically, DLL injection is when a program is forced to load arbitrary code into it's memory and have it executed. It can be applied in various ways, such as giving us an unfair advantage in video games, or have malicious code executed onto a computer.


--HOW DOES DLL INJECTION WORK?--
There are a number of function in the Windows API that aloows us to inject our code into a process. DLL injector tools such as RemoteDLL or Cheat Engine can also be used which use said functions to inject our dlls into a process.

The complete process of having a DLL injected into a process can be broken down to four parts-
1. Attaching to the targetted process using a handle; using function OpenProcess();
2. Allocating memory in the process for the dll; using function VirtualAllocEx()/ReadProcessMemory();/WriteProcessMemory();
3. Copying the DLL path to memory using LoadLibraryA();
4. Executing the DLL using CreateRemoteThread();
Here's an image by OpenSecurityResearch that explains the whole process: http://i.imgur.com/DAdnJyw.png


--DLL PROXYING--
This is a method which is commonly used to bypass "activation" restrictions on programs, or get arbitrary code to load into a process along and forwards the function calls to the legitimate dll.
It is done by simply renaming your dll to the one used by the program, then replacing them.

This is sort of how it works (imagine an XKCD background, with "PlsNotHack.dll" being the replaced dll used by the application)

EpikGame.exe: yo PlsNotHack.dll, gimme the time and date.
PlsNotHack.dll: alright sure man I'll ask LegitimateDll.dll real quick and get back to u
LegitimateDll.dll: it's 18th of April, 3:33PM
PlsNotHack.dll: it's 18th of April, 3:33PM; also let me see and shoot through walls.
EpikGame.exe: alright done thanks


--CHEATENGINE--
Cheat Engine is another nifty tool used for process injection and memory altering.
It attaches itself to a selected process, and then scans the memory of the process. It can be used to get ourselves infinite health in a game by asking CE to scan the memory with the value of our current health. When the correct address for the health value in the memory is found, we can alter the value to a desired number, such as 9999.


--CONCLUSION--
In this (sad excuse of a) writeup, we went over what DLLs are, what is DLL injection, how to achieve it and what do we get out of it.

Thanks for reading!


SOURCES
http://en.wikipedia.org/wiki/DLL_injection
http://blog.opensecurityresearch.com/2013/01/windows-dll-injection-basics.html
http://www.bluenotch.com/files/Shewmaker-DLL-Injection.pdf
http://www.codeproject.com/Articles/5178/DLL-Injection-and-function-interception-tutorial
http://en.wikipedia.org/wiki/Cheat_Engine