CODEWITHSUNDEEP
c++code-injectionmemory-dump
user1438233
user1438233

Reputation: 1233

identify memory code injection by memory dumping of process or dll

In order to identify memory code injection (on windows systems), I want to a hash the memory of all processes on the system, for example, if the memory of calc.exe is always x and now it is y, I know that someone injected into calc.exe code.

1: Is this thinking correct? What part of the process memory always stays the same and what part is changing?

2: Dose dll have a separate memory, or it is in the memory of the exe? In other words, can i generate a hash for memory of a dll?

3: How can I dump the memory of a process or of a dll in c++?

Upvotes: 1

Views: 1697

Answers (3)

capsch
capsch

Reputation: 143

I have just done something similar I basically c#'s these scripts:

http://www.exploit-monday.com/2012/03/powershell-live-memory-analysis-tools.html

Upvotes: 0

AndreVa
AndreVa

Reputation: 131

Code is continually being injected in processes when running windows.

One example are delay loaded DLLs. When a process starts up, only the core DLLS are loaded. When certain features get exercised, the code first loads the new DLLs (code) from disk and then executes it.

Another example is .NET managed applications. Most code sits as uncompiled code on disk. When new parts of the application need to be run, the .NET runtime loads that uncompiled code, compiles it (aka JITs it) and then executes it.

The problem you are trying to solve is worthwhile, but extremely hard. The OS itself tries to solve this problem to protect your processes.

If you are trying to do something more advanced than what windows is doing for you behind the scenes, the first thing to do will be to understand all the steps windows takes to protect process and validate the code being injected in them, while still enabling processes to load code dynamically (which is a necessity).

Good luck.

Or maybe you have a more specific problem you are trying to solve?

Upvotes: 3

Christophe
Christophe

Reputation: 73530

1) The idea is nice. But as long as the process runs, they change their memory (or they do nothing) so it won't work. What you could do, is to hash the code part of the memory.

2) No, DLL are libraries linked to your code, not a separate process. They are just loaded dynamically instead of statically (http://msdn.microsoft.com/en-us/library/windows/desktop/ms681914%28v=vs.85%29.aspx)

3) Normally your OS prohibits you from accessing memory of neighbour processes. If it would allow it for your process, then it would be very easy for malware to propagate, and your system would be very instable, as one crashing process could crash all the others. So it'll be very very tricky to do such kind of dumps ! But if your process has the right priviledges, you could have a look at ReadProcessMemory()

Upvotes: 1

Related Questions