Injected code could represented by, but not limited to:
Remotely created thread could be detected by several techniques:
- Periodically check if process threads were created by current process using
For each thread check if it is running from the address space of the original executable and not from some orphaned memory page:
- Set second parameter to
GetModuleInformation - check if the thread starting address is in the range of each of the loaded modules and those modules are legit (by known list/by path).
- Check here too.
Monitor thread creating API inside current process and also check if the creating PID belong to current process -
- Monitor memory protection APIs (
VirtualProtect) to detect if someone tries to modify your code and then check if that "someone" belongs to legit process address space.
- By keeping the list of legit loaded modules, one also can check if each thread in process belong to address space of a legit module from the list.
LoadLibrary for a chance someone trying to load unknown module into your process.
Injected code without thread
Check the integrity of your process - look for hot patching of various APIs, depends on the process. Injected code could be triggered by some patch inside current process.
Monitor APC creating API (
KiUserApcDispatcher) if the target code belongs to current process. OS's APC also could be filtered out.
There are other ways to inject code, even before the legit process will start to run and place its protections - using combination of
SetThreadContext which theoretically could bypass all your implemented protections. When your code and injected one are only running in the same ring (user mode), it all goes down to who is gaining control first. Look for code cave method and think for example when malcode is injected into explorer.exe and you are starting your program :-).
Of cause, you can load your driver into kernel, which will give you more solid control over the code injection to your process and a good protection, but that of cause depends on the skills and what you are trying to protect.
Injected code inaweza kuwakilishwa na, lakini si mdogo kwa: Remote kuundwa thread inaweza kugunduliwa na mbinu kadhaa: - mara kwa mara kuangalia kama mchakato threads walikuwa kuundwa na mchakato wa sasa kwa kutumia kwa kila thread kuangalia kama ni mbio kutoka nafasi ya anwani ya awali executable na si kutoka baadhi ya kumbukumbu ya yatima ukurasa: - Kuweka parameter ya pili kwa GetModuleInformation - kuangalia kama thread kuanzia anwani ni katika mbalimbali ya kila modules kupakiwa na modules ni halali. - Angalia hapa pia. "Kuchunguza thread kuunda API ndani ya mchakato wa sasa na pia kuangalia kama kujenga PID ni mali ya mchakato wa sasa - ""Kuchunguza kumbukumbu ulinzi API (VirtualProtect) kugundua kama mtu anajaribu kurekebisha code yako na kisha kuangalia kama kwamba ""mtu"" ni mali ya legit mchakato anwani nafasi." - Kwa kuweka orodha ya legit kupakiwa modules, moja pia inaweza kuangalia kama kila thread katika mchakato ni mali ya anwani nafasi ya legit moduli kutoka orodha. LoadLibrary kwa nafasi mtu kujaribu kupakia moduli haijulikani katika mchakato wako. Injected code bila thread Angalia uadilifu wa mchakato wako - kuangalia kwa ajili ya moto patching ya API mbalimbali, inategemea mchakato. Injected code inaweza kuwa triggered na baadhi ya patch ndani ya mchakato wa sasa. Utafiti wa API ya KiUserApcDispatcher ikiwa nambari ya lengo ni ya mchakato wa sasa. Utaratibu wa APP wa OS unaweza pia kuondolewa. Kuna njia nyingine ya kuingiza kanuni, hata kabla ya mchakato halali itaanza kukimbia na kuweka ulinzi wake - kutumia mchanganyiko wa SetThreadContext ambayo kinadharia inaweza kuepuka ulinzi wako wote kutekelezwa. Wakati code yako na moja injected ni tu mbio katika pete moja (mtumiaji mode), ni wote huenda chini ya ambaye ni kupata udhibiti wa kwanza. Tafuta code pango mbinu na kufikiri kwa mfano wakati malcode ni injected katika explorer.exe na wewe ni kuanza programu yako :-). Kwa sababu, unaweza kupakia dereva wako katika kernel, ambayo itakupa udhibiti thabiti zaidi juu ya sindano ya code kwa mchakato wako na ulinzi mzuri, lakini hiyo ya sababu inategemea ujuzi na nini wewe ni kujaribu kulinda.