3 ms·
Usually, you don't need to replace a system dll at all. You can just drop an alter ego in exe's own directory or even in a launch directory. Default search orde
by eps 6y ago
Usually, you don't need to replace a system dll at all. You can just drop an alter ego in exe's own directory or even in a launch directory. Default search order in Windows is such that it'll pick up from the latter two first and check PATH second.
Once the process is up and running it has the control over this (with LoadLibraryEx and SetDefaultDllDirectories) and it's also possible to tighten search logic at the OS level (with a registry patch), but if the machine is under attacker's control, the only option is to validate loaded module list from within the app.
- Const-me 6y agodwm.exe is in the same directory, c:/Windows/System32. The process is launched by Windows automatically, immediately after login. The desktop capture app I was working on is launched way later than that, by user.
- eps 6y agoAh, right. Missed the part it was dwm.exe
- garaetjjte 6y agoThough some core system DLLs are specified in KnownDLLs registry key, and thus not loaded from application directory.
- deleted 6y ago[deleted]