Read this first: This section explains the idea of DLL injection so that you can recognise and defend against it. It deliberately gives no instructions, no code, no function sequences and no tools for doing it. Understanding what something is and how it is stopped is part of every IT professional's knowledge. Trying it on systems you do not own is illegal in most places.
The Big Picture: A Guest Who Was Not Invited
Normally, a program decides which DLLs it loads (Section 3). The program is the host at a dinner party, and it chooses the guests.
DLL injection is when someone else gets a program to load a DLL that the program did not choose. The extra guest then runs inside the host's house, with the host's keys.
8.1 What DLL Injection Is, Technically
What it is: In plain words: DLL injection is any technique that makes a running process load a DLL that its author did not intend it to load.
Once a DLL is loaded into a process, its code runs inside that process, with the same rights and the same access to that process's memory (see Chapter 9 for process memory and Chapter 8 for how the system keeps processes apart). Windows normally keeps processes separated, so one process cannot reach into another's memory. Injection is about getting around that wall.
Why a DLL? Because a DLL is the natural way to add code to a process. The loader already knows how to map it, fix its addresses and run DllMain (Section 3). The injected DLL gets all this for free.
Normal Injected (concept)
┌─────────────────────┐ ┌─────────────────────┐
│ App process │ │ App process │
│ app.exe │ │ app.exe │
│ kernel32.dll │ │ kernel32.dll │
│ user32.dll │ │ user32.dll │
│ │ │ EXTRA.dll <-- not │
│ (DLLs the app chose)│ │ chosen by the app │
└─────────────────────┘ └─────────────────────┘
Related ideas you may hear about (names only, no details):
- Hooking: changing where a function call goes so that extra code runs first. Hooks often live in a DLL.
- Search order hijacking (Section 4.6): a related weakness in which a bad DLL is loaded because of the folder order, without touching a running process.
- Application-level settings and registry-based loading: some Windows features exist so that DLLs are loaded into certain processes, and security tools watch them.
8.2 Legitimate Uses vs Malicious Uses
What it is: The same basic idea, "run extra code inside another program", has both good and bad uses. The difference is permission and purpose.
| Use | Who | Why |
|---|---|---|
| Debuggers | Developers | Watch and control a program they are fixing |
| Profilers | Developers | Measure which parts of a program are slow |
| Accessibility tools | Screen readers | Read the text and buttons of other programs to speak them aloud |
| Overlays | Game tools, screen recorders | Draw a frame-rate counter or capture the video on top of a game |
| Antivirus and EDR | Security products | Watch what programs do (EDR = Endpoint Detection and Response, a security tool that looks for suspicious behaviour) |
| Compatibility fixes | Windows itself ("shims") | Let old programs run on new Windows |
| Malware | Attackers | Hide inside a trusted program, spy on it (steal passwords or card data from a browser), or avoid detection by running under a trusted name |
| Cheating tools | Cheaters | Change the behaviour of an online game |
Why legitimate tools can look like malware to security software: Because the technique is the same. Security programs have to judge who is doing it, whether the file is signed, and how it behaves. That is why some harmless overlay tools sometimes get flagged by antivirus or blocked by games.
8.3 Why This Is a Security-Monitored Technique
What it is: Because the technique is so powerful, Windows and security software watch for it and limit it. This is defence in depth: many small barriers instead of one big one.
How Windows and security tools defend:
| Defence | What it does (simple version) |
|---|---|
| Separate address spaces | Each process has its own private memory map. One process cannot touch another's memory by default |
| Access rights | To work on another process, a program needs permission to that process. A normal user program cannot open a system process or one running as a higher-privileged user |
| User Account Control (UAC) | Programs run with limited rights unless you approve more |
| Protected Processes and PPL | Protected Process Light (PPL): a special mode for some Windows and security services. Even an administrator cannot easily alter them, and they accept only properly signed code |
| Code signing | Some processes only load DLLs signed by Microsoft or a trusted publisher (signature enforcement, which uses digital signatures to prove who made a file and that it was not changed) |
| Mitigation policies | A program can ask Windows to block DLLs that are not signed, or that come from a remote location (hedge: exact options vary by Windows version) |
| Antivirus / EDR and Windows Defender | Watch for suspicious process behaviour and block known bad files |
| Memory integrity (HVCI) | A Windows security feature that uses the virtualisation features of the CPU to protect the kernel from unsigned code (hedge: settings vary by PC) |
| Event logging | Security tools record loads of unusual modules, so analysts can investigate |
What you can safely look at: your own processes. Seeing which modules a process has loaded is a basic, read-only way to understand normal behaviour:
Get-Process -Name notepad | Select-Object -ExpandProperty Modules
tasklist /m /fi "imagename eq notepad.exe"Look at the paths. Normal modules come from C:\Windows\System32, C:\Windows\WinSxS or the program's own folder under C:\Program Files. A DLL in a temporary folder, or with a strange name in a user folder, deserves a second look. In Process Explorer (optional), the Verified Signer column helps you check whether a DLL is signed.
What you can do as a user to stay safe:
- Keep Windows, your browser and your apps updated.
- Keep Windows Security (or another trusted antivirus) switched on.
- Download programs only from their official sites or the Microsoft Store.
- Keep UAC on. Do not run unknown programs as administrator.
- Be careful with "cheats", cracks and "free DLL fixers". They are a common way to get malware.
- If a security tool says a program loaded something suspicious, take it seriously.
Remember: Understanding the idea helps you tell a normal module list from a suspicious one. It is a defence skill. This course does not teach how to perform it.
Summary
| Topic | Remember this |
|---|---|
| DLL injection | Making a running process load a DLL its author did not choose |
| Why DLL | The loader already knows how to run DLL code inside a process |
| Legitimate | Debuggers, profilers, accessibility, overlays, security tools, compatibility shims |
| Malicious | Hiding in or spying on a trusted program |
| Defences | Separate memory, access rights, UAC, PPL, code signing, mitigation policies, antivirus/EDR, memory integrity |
| What you can do | Look at modules in your own processes, keep software updated, use official downloads |
| Scope | Concept and defence only |