{"componentChunkName":"component---src-templates-post-template-js","path":"/windows-create-dll-en","result":{"data":{"markdownRemark":{"id":"73465f4e-fe2e-5f8d-90cc-06697f041207","html":"
\n

This page has been machine-translated from the original page.

\n
\n

This time, I tried several methods for creating a DLL file on Windows and loading it into a process.

\n

This article is not intended to publish information that violates laws or ethics.

\n\n

Table of Contents

\n\n

Create a Hello World DLL

\n

In Visual Studio, create a new DLL project and replace dllmain.cpp with the following code to create a DLL that displays the string Hello, World! in a message box when it is loaded.

\n
#include <Windows.h>\n\n// Exported function\nextern \"C\" {\n    __declspec(dllexport) void ShowMessage() {\n        MessageBoxA(NULL, \"Hello, World!\", \"DLL Message\", MB_OK | MB_ICONINFORMATION);\n    }\n\n    __declspec(dllexport) void ShowMessage2() {\n        MessageBoxA(NULL, \"Hello, New World!\", \"DLL Message\", MB_OK | MB_ICONINFORMATION);\n    }\n}\n\nBOOL APIENTRY DllMain( HMODULE hModule,\n                       DWORD  ul_reason_for_call,\n                       LPVOID lpReserved\n                     )\n{\n    switch (ul_reason_for_call)\n    {\n    case DLL_PROCESS_ATTACH: {\n        ShowMessage();\n        break;\n    };\n    case DLL_THREAD_ATTACH:\n    case DLL_THREAD_DETACH:\n    case DLL_PROCESS_DETACH:\n        break;\n    }\n    return TRUE;\n}
\n

At this time, ShowMessage, which is the function that displays the message box, is defined as an exported function by extern __declspec(dllexport) void ShowMessage().

\n

Reference: Exporting from a DLL Using __declspec(dllexport) | Microsoft Learn

\n

Because this ShowMessage function is called during DLL_PROCESS_ATTACH, it runs when the DLL is loaded into the process.

\n

\n \n \n \n \n \n \n \n \n

\n

When building the sample DLL code, disable the precompiled header, which is not particularly necessary here.

\n

\n \n \n \n \n \n \n \n \n

\n

Best Practices for DLLMain

\n

The DllMain function appears to have several restrictions because it runs while the loader lock is held, as shown in the following diagram.

\n

\n \n \n \n \n \n \n \n \n

\n

As described in the public information below, which summarizes best practices for DllMain, you need to be careful not to cause deadlocks or crashes through DllMain behavior.

\n

For example, because the DllMain thread holds the loader lock, it cannot dynamically load additional DLLs.

\n

Reference: Dynamic-Link Library Best Practices - Win32 apps | Microsoft Learn

\n

Load a DLL into a Process

\n

A process can load a module file from disk by using the LoadLibrary function and specifying the module’s file name.

\n
HMODULE LoadLibraryA(\n  [in] LPCSTR lpLibFileName\n);
\n

Reference: LoadLibraryA function (libloaderapi.h) - Win32 apps | Microsoft Learn

\n

At this time, it seems that you can specify either a full path or just a file name for lpLibFileName, but if you specify only the file name, the DLL is loaded according to the standard search order.

\n

DLL Search Order

\n

The standard search order varies depending on several conditions, but for now, if the “safe DLL search mode,” which is enabled by default, is active and the application is not using an alternate search order, DLLs appear to be searched in the following order.

\n
    \n
  1. The directory from which the application loaded.
    2. \n
  2. The system directory.
    3. \n
  3. The 16-bit system directory.
    4. \n
  4. The Windows directory.
    5. \n
  5. The current directory.
    6. \n
  6. The directories that are listed in the PATH environment variable.
    7. \n
\n

The key point is that the current directory, which is relatively easy to abuse, is lower in the order.

\n

Reference: Dynamic-link library search order - Win32 apps | Microsoft Learn

\n

Reference: Dynamic-Link Library Security - Win32 apps | Microsoft Learn

\n

In fact, when I tried this on my local Windows 10 environment, I was able to confirm events that seemed to show the DLL search proceeding in the order above, starting from the folder where the application’s executable file was located.

\n

\n \n \n \n \n \n \n \n \n

\n

\n \n \n \n \n \n \n \n \n

\n

At that time, the search order for the DLL to load was, by default, the same as the standard search order.

\n

However, because the process doing the loading is the remote process, the preferred lookup location is not the execution folder of the program performing the DLL injection, but the folder where the target process’s executable file exists.

\n

Therefore, when performing DLL injection with this method, you need to specify the full path to the target DLL file or place the DLL file to be loaded in advance in the application folder, system folder, or another folder included in PATH.

\n

Below is the search order for TESTDLL.dll when attempting DLL injection into Notepad++.

\n

\n \n \n \n \n \n \n \n \n

\n

About Reflective DLL Injection

\n

The DLL injection method above simply loads a DLL that exists as a file.

\n

However, when DLL injection techniques are used for malicious purposes, it seems that a technique called Reflective DLL Injection is often abused instead of this kind of classic method.

\n

Reference: Reflective DLL Injection | Sunano Katamari

\n

Reference: Investigating Malware with Reflective DLL Injection - CyberFortress

\n

I will not describe the detailed implementation because it could potentially cause some trouble, but the articles above explained it in great detail and were very helpful.

\n

Summary

\n

This time, I summarized several methods for loading DLLs on Windows.

","fields":{"slug":"/windows-create-dll-en","tagSlugs":["/tag/win-dbg/","/tag/reversing/","/tag/english/"]},"frontmatter":{"date":"2025-01-05","description":"I created a DLL file on Windows and tried loading it into a process in various ways.","tags":["WinDbg","Reversing","English"],"title":"Create a DLL File on Windows and Try Loading It into a Process in Various Ways","socialImage":{"publicURL":"/static/ef75a61ab35d3aa8f659b3ad8e77557e/windows-create-dll.png"}}}},"pageContext":{"slug":"/windows-create-dll-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}