Posted about 1 year ago, by Specific

If you've been using Windows for any length of time, you should be familiar with the registry.  The configuration for the entire system and most software is maintained in the registry, and you can alter the behavior of the system by tweaking its settings.  In this tutorial of how to inject a DLL using the registry, the entry I'll discuss is in the following key:


*Note* Windows 98
Windows 98 ingores this registry key, so you cannot use this technique to inject a DLL under Windows 98.

The window here shows what the entries in this key look like when viewed in Registry Editor.  RegEditThe value for this key might contain a single DLL filename or a set of DLL filenames (seperated by spaces or commas).  Since spaces delimit filenames, you must avoid filenames that contain spaces.  The first DLL filename listed might include a path, however, any other DLLs that contain a path are ignored.  For this reason, it is usually best to place your DLL in the Windows system directory so that paths need not be specified.  In the window I have set the value to a single DLL pathname, MyLib.dll, which is located in the Windows system directory.

When you restart your machine and Windows initializes, the system saves the value of this key.  Then when the User32.dll library is mapped into a process, it receives a DLL_PROCESS_ATTACH notification.  When this notification is processed, User32.dll retrieves the saved value of this key and calls LoadLibrary for each DLL specified in the string.  As each library is loaded, the library's associated DllMain is called with a fdwReason value of DLL_PROCESS_ATTACH so that each library can initialize itself.  Because the injected DLL is loaded so early in the process's lifetime, you must exercise caution when calling functions.  There should be no problem calling functions in Kernel32.dll, however, calling functions in some other DLL might cause problems.  User32.dll does not check whether each library has been successfully loaded or initialized.

This method of injecting a DLL is by far the easiest.  All you have to do is add a value to an already existing registry key. 

Author Info Comment
Support
Posted about 1 year ago.
User Avatar

Very helpful! Thanks Specfic