5 ms·

Readers here are all very likely to appreciate some links alongside statements, cause really this is a sensitive topic. Both statements need certain context as

by larodi 2y ago

Readers here are all very likely to appreciate some links alongside statements, cause really this is a sensitive topic. Both statements need certain context as it seems it’s not the universal understanding of what goes on and how often.

davidczech 2y ago
SetWindowsHookEx is a blast.
mike_hearn 2y ago
Not sure it can be proven with citations but it's well known that process injection is widely used on Windows. GPU drivers are known to do it. Utilities have historically often injected code into Explorer. Raymond Chen has written in the past about this problem and how hard it made it to evolve the platform.
- ori_b 2y ago
  > Raymond Chen has written in the past about this problem That would be a citation. Do you have a link?
  - Rexxar 2y ago
    You install tortoiseSVN or something similar, look at explorer.exe process or any process that use a standard "Open File" widget, and you will see some dll from the utility loaded by the process. (Easy to see with process explorer from sysinternals)
    - iggldiggl 2y ago
      I think tortoiseSVN and consorts are "just" a shell extension, though, which is an officially supported concept, even if that means that potentially any random software using the standard file dialogues ends up loading your DLL, too.
  - jasomill 2y ago
    Three random Explorer examples: https://devblogs.microsoft.com/oldnewthing/20230911-00/?p=108749 https://devblogs.microsoft.com/oldnewthing/20230911-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20230324-00/?p=107966 https://devblogs.microsoft.com/oldnewthing/20230324-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20220613-00/?p=106746 https://devblogs.microsoft.com/oldnewthing/20220613-00/?p=10... For code injection into applications that don't load third-party DLLs as plugins, see, e.g., Microsoft's (unsupported) toolkit for runtime API interception: https://github.com/microsoft/Detours https://github.com/microsoft/Detours

by larodi 2y ago

davidczech 2y ago

SetWindowsHookEx is a blast.

mike_hearn 2y ago

Not sure it can be proven with citations but it's well known that process injection is widely used on Windows. GPU drivers are known to do it. Utilities have historically often injected code into Explorer. Raymond Chen has written in the past about this problem and how hard it made it to evolve the platform.

ori_b 2y ago
> Raymond Chen has written in the past about this problem That would be a citation. Do you have a link?
- Rexxar 2y ago
  You install tortoiseSVN or something similar, look at explorer.exe process or any process that use a standard "Open File" widget, and you will see some dll from the utility loaded by the process. (Easy to see with process explorer from sysinternals)
  - iggldiggl 2y ago
    I think tortoiseSVN and consorts are "just" a shell extension, though, which is an officially supported concept, even if that means that potentially any random software using the standard file dialogues ends up loading your DLL, too.
- jasomill 2y ago
  Three random Explorer examples: https://devblogs.microsoft.com/oldnewthing/20230911-00/?p=108749 https://devblogs.microsoft.com/oldnewthing/20230911-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20230324-00/?p=107966 https://devblogs.microsoft.com/oldnewthing/20230324-00/?p=10... https://devblogs.microsoft.com/oldnewthing/20220613-00/?p=106746 https://devblogs.microsoft.com/oldnewthing/20220613-00/?p=10... For code injection into applications that don't load third-party DLLs as plugins, see, e.g., Microsoft's (unsupported) toolkit for runtime API interception: https://github.com/microsoft/Detours https://github.com/microsoft/Detours