DLL Trojan secrets

I believe you often playTrojanWill all knowTrojanWill also have their favorite featuresTrojanHowever, many friends still do not know the recent rise of "DLLTrojan"Why. What is "dll "?Trojan? It is similar to the GeneralTrojanWhat is the difference?

I. Starting with DLL technology

To learn about DLLTrojan, You must know what this "DLL" means, so let's trace back to the days when the DOS system went viral a few years ago. At that time, writing a program was a tedious task, because the code of each program was independent. Sometimes a lot of code was required to implement a function. Later, with the development of programming technology, programmers put a lot of common code sets (General Code) into an independent file and call this file a "library". When writing a program, add this library fileCompilerYou can use all the functions in this library without having to write a lot of code on your own. This technology is called static link ). The static link technology relieved tired programmers, and everything seemed wonderful. But it turns out that beautiful things won't exist for too long, because static links are like a rude salesman. Whether you want a leaflet or not, they are all put into your hands. To write a program, you only need to use a certain graphic effect contained in a library file. Because of this, you have to add all the graphic effects carried by this library file to the program, it is not important to keep them as vase decoration, but these vase blocks the road-static link technology makes the final program into a big block, becauseCompilerCalculate the entire library file.

With the development of time generation, static link technology cannot satisfy the programmer's aspirations due to inherent drawbacks. People begin to look for a better way to solve the problem of code duplication. Later, the Windows system emerged, and the watershed of the Times finally emerged. Windows systems use a new connection technology, known as dynamic link, which also uses library files,MicrosoftThey are called"Dynamic Link Library"-- Dynamic Link Library, DLL name is like this. The dynamic link itself is no different from the static link itself. It also writes the common code into some independent files, but in terms of compilation,MicrosoftWithout adding the library files to the program, we made the library files into compiled program files and opened an interface for data exchange, when a programmer writes a program, once a function of a library file is used, the system transfers the library file to the memory and connects the task process occupied by the program, then execute the function to be used by the program and display the result to the program. In our view, it is like the function provided by the program itself. After the required functions are completed, the DLL stops running and the entire call process ends.MicrosoftThis allows these library files to be called by multiple programs and achieves perfect sharing. No matter what program you want to write, you only need to add the call declaration to the relevant DLL in the code to use all of its functions. The most important thing is that the DLL will never let you get another vase. You will give it to you if you want anything, and it will not give you anything you don't want. In this way, the written program can no longer carry a lot of garbage-it will never let you take the leftovers home, or it will be fine. This is a buffet.

The birth of DLL technology makes programming a simple task. Windows provides thousands of function interfaces to meet the needs of most programmers. Moreover, the Windows system itself is composed of thousands of DLL files, which support each other and form a powerful Windows system. What is the size of static link in windows? I dare not think about it.

2. Application Interface API

Above we made a rough analysis on the DLL technology, in which I mentioned "interface", what is this? Because the DLL cannot be inserted into the program like a static library file, it is a problem to let the program know the code and files that implement the function,MicrosoftThe DLL technology has been standardized so that a DLL file opens many small holes like a cheese, and each hole is marked with the name of the stored function, as long as the program finds the relevant hole according to the standard specification, it can get the desired taste. This hole is the "Application Programming Interface". The interfaces of each DLL are different, the Code duplication is minimized. Using Steven's sentence: the API is a toolbox. You can take out the screw knives and wrenches as needed and put them back to the original place after they are used up. In Windows, the three most basic DLL files are kernel32.dll, user32.dll, and gdi32.dll. They constitute a basic system framework.

Iii. dll andTrojan

DLL is the compiled code, which is no big difference from the general program, but it cannot run independently and needs to be called by the program. Then, DLL andTrojanWhat is the link? If you have learned programming and written DLL, you will find that the DLL code is almost the same as that of other programs, except that the interface is different from the startup mode. You only need to change the code input port, the DLL becomes an independent program. Of course, there is no program logic in the DLL file. This does not mean DLL = exe. However, you can still regard the DLL as the EXE without the main entry, each function in the DLL can be regarded as several function modules of a program. DLLTrojanIs to implementTrojanFunction Code, add some special code to write the DLL file, export the relevant API, in others' opinion, this is just a common DLL, but this DLL carries the completeTrojanFunction, which is the DLLTrojan. Some may ask, since the same code can be implementedTrojanFunction, then you can directly program it. Why do you need to write it as a DLL? This is to hide, because the DLL Runtime is directly linked to the process of the program that calls it, and does not produce other processes, so compared with the traditional exeTrojanIt is difficult to find.

Iv. dll running

Although the DLL cannot be run by itself, Windows requires an entry function when loading the DLL, just like the main of the exe. Otherwise, the system cannot reference the DLL. Therefore, according to the compiling rules, windows must find and execute a function dllmain In the DLL as the basis for loading the DLL. This function is not exported as an API, but an internal function. The dllmain function keeps the DLL in the memory. Some DLL does not have the dllmain function, but it can still be used because Windows cannot find dllmain, find a default dllmain function that does not perform any operation from other runtime libraries to start the DLL so that it can be loaded. It does not mean that the DLL can discard the dllmain function.

V. dllTrojanTechnical Analysis

Here, you may think that since the DLLTrojanThere are so many benefits for writing in the futureTrojanAre you sure you want to use the DLL method? This is true, but the DLLTrojanIt is not as easy to write as some people think. Write a usable DLLTrojanTo learn more.

1.TrojanSubject

NeverTrojanThe module is actually written like an api library, which is not a winapi development. DLLTrojanSeveral auxiliary functions can be exported, but there must be a process responsible for mainly executing the code. Otherwise, this dll can only be a bunch of fragmented API functions, so don't mention the work.
If some common code is involved, you can write some internal functions in the DLL for your own code, instead of opening all the Code as an interface, so that it is difficult to call itself, it is even less likely to play a role.
DLLTrojanThe Standard execution entry of is dllmain, so you must write the DLL in dllmainTrojanCode to run, or point to the DLLTrojan.

2. Dynamic embedding technology

In Windows, each process has its own private memory space. Other processes are not allowed to operate on this private territory. However, in fact, we can still use various methods to access and operate the private memory of the process. This is dynamic embedding, which is a technology that embeds its own code into the running process. There are many kinds of dynamic embedding, the most common is the hook, API and remote thread technology, most of the current DLLTrojanThey all use remote Thread Technology to hang themselves in a normal system process. In fact, dynamic embedding is not uncommon. The Logitech mouseware driver hangs on every system process -_-

The remote thread technology is to create a remote thread (remotethread) in another process to enter the memory address space of that process. In DLLTrojanThis technology is also called "injection". When the carrier creates a remote thread in the injected process and commands it to load the DLL,TrojanAnd no new processes are generated.TrojanStop and only connect thisTrojanThe DLL process exits. However, for a long time, we can only pull the Wizard together with assumer.exe. Are you sure you want to disable windows?

3.Trojan.

Some people may be impatient to say that it is okay to directly add this DLL to the system startup project. The answer is no. As mentioned earlier, DLL cannot run independently, so it cannot be started directly in the startup project. To makeTrojanWhen running, an EXE needs to use dynamic embedding technology to get the DLL to another normal process vehicle, so that the embedded process can call the DLL's dllmain function to stimulateTrojanRun and startTrojan,TrojanStarted.

Start DLLTrojanIs an important role, it is called loader, if there is no loader, DLLTrojanIs a bunch of broken, so a mature DLLTrojanWill find a way to protect its loader will not be so easy to destroy. Do you remember the story of being a zombie? DLLTrojanIt is the embarrassment of crawling on the wolf loader.

Loadercan be multiple types of directories. Windows rundll32.exe is also named by some DLLTrojanUsed for loader.TrojanGenerally, without dynamic embedding technology, the runtime directly hangs on the rundll32process, and uses the rundll32's runtime (rundll32.exe [DLL name], [function] [parameter]) to reference the startup function of this DLL like calling an API to stimulateTrojanThe module starts execution, even if you kill rundll32,TrojanThe ontology is still in use. The most common example is 3721 Chinese real name, although it is notTrojan.

RegistryThe appinit_dlls key is alsoTrojanUsed to start yourself, such as a cover letterVirus. ExploitationRegistryTo enable the system to execute dllmainTrojan. Because it is transferred by kernel, there is a lot of requirement on the stability of this DLL, a slight error will cause the system to crash, so we seldom see thisTrojan.

There are some more complex DLLTrojanStarted through svchost.exe. This DLLTrojanIt must be written as NT-service. The entry function is servicemain, which is rarely seen.TrojanAnd the loader is secure.

4. Others

At this point, we should alsoTrojanDo you really want to write one? Don't worry, I don't know if you have thought about it. Since the DLLTrojanSo good, why can we find the DLLTrojanFew? Now let me splash cold water, the most important reason is only one: because of the DLLTrojanIf a system process fails to run, for example, if it does not properly write code that prevents running errors or does not strictly regulate user input, the DLL will crash. Don't be nervous. The general EXE is also finished like this, but the DLL crash will cause the program hanging on it to suffer. Don't forget that it is connected to the system process. The final result is ...... Terrible. So write a published DLLTrojan, The Troubleshooting work is better than the general exeTrojanToo much, too much to write ......

Vi. dllTrojanDetection and removal

I often check whether there are many inexplicable items in the startup items. This is where loader is located. If a wolf is killed, it cannot be mad again. While DLLTrojanIt is difficult to find the ontology. You need to have some programming knowledge and analysis capabilities. Find the DLL name in the loader, or check the process for any unfamiliar DLL, but for the novice ...... In short, it is relatively difficult, so the simplest method is: anti-virus software andFirewall(Do not take this medicine for a long time)