2

I have a process that doing some inline hooks on WinSock module (Send and Receive functions). On a machine with McAfee I can see that two dlls are being injected into my process:

  • hipi.dll
  • hipqa.dll

Both are also doing probably inline hooking on those functions and I get collisions and unwanted behaviors. Is there an option to prevent/unload those dlls so they will not interfere?

10x, Guy

Guy
  • 915
  • 2
  • 14
  • 27
  • What does this have to do with C++? – Kiril Kirov Feb 04 '13 at 08:38
  • 2
    Link :http://stackoverflow.com/questions/9450372/prevent-dll-injection-from-an-dll-c –  Feb 04 '13 at 08:41
  • @meh The code of my process is in C++. So if there is a code solution it should be in C++... – Guy Feb 04 '13 at 08:45
  • 2
    "Uninstall McAfee" or "Add exclusion" are not answers when it comes to professional software development, unfortunately. – MSalters Feb 04 '13 at 09:26
  • 1
    possible duplicate of [How would I go about prevent DLL injection](http://stackoverflow.com/questions/869320/how-would-i-go-about-prevent-dll-injection) – MSalters Apr 30 '13 at 00:09

6 Answers6

1

There are many scenario to achieve DLL injection(Hooking), BTW, you must learn more about how stuff works behind every method, the most common one is by using CreateRemoteThread() API function, then you must to inject your security DLL on every process and hook/redirect/deny any call to CreateRemoteThread() or any "dangerous" API call.

PS: BUT keep in your mind:

user-mode hooking can NEVER be an option to apply additional security checks in any safe manner. If you only want to “sandbox” a dedicated process, you know well about, and the process in fact doesn’t know about EasyHook, this might succeed! But don’t ever attempt to write any security software based on user mode hooking. It won’t work, I promise you…

Marwen Trabelsi
  • 4,167
  • 8
  • 39
  • 80
  • @MSalters: Preventing hook made by hooking the function that's make the hook(eg: CreateRemoteThread(), virtualallocex), and that's how antivirus works... – Marwen Trabelsi Apr 29 '13 at 17:12
  • 1
    [If you're still not convinced ask yourself, why antivirus software uses the hook?](http://stackoverflow.com/questions/869320/how-would-i-go-about-prevent-dll-injection) – Marwen Trabelsi Apr 29 '13 at 17:20
  • Good link, this Q is a duplicate. – MSalters Apr 30 '13 at 00:08
  • Yes, but don't forget to undo the (-1) :). – Marwen Trabelsi Apr 30 '13 at 00:15
  • I'm not yet convinced that it's an answer. You think it's possible to inject your DLL into McAfee, a virus scanner? That sounds like a very weak product. – MSalters Apr 30 '13 at 00:20
  • Agree with you, however it's a great solution to protect his process from being hooked by malware, perhaps i have not answer to the case of McAfee(and yes this will be weak as you said), i have read a book about detecting keyloggers using a heuristic scan, and in this way that can be done. – Marwen Trabelsi Apr 30 '13 at 01:12
0

You have 2 options.

  1. Add an exclusion for your process so that McAfee doesn't attempt to scan it. I don't use McAfee's products, but I would assume that this would be a relatively straightforward process.
  2. Uninstall McAfee
CadentOrange
  • 3,263
  • 1
  • 34
  • 52
0

The easiest solution is to just unhook the affected functions. I had to do the same to work around some Dell crapware. It's not excessively hard, even though it requires some understanding of x86 assembly. You have to disable DEP, make the patched code writeable, find the original instructions, and copy them back. Finding the original instructions probably means disassembling the patch.

MSalters
  • 173,980
  • 10
  • 155
  • 350
0

Another alternative is simply to hook it at a different place. For example, hook the IAT instead and then when you are done with whatever you want, forward execution back to the real function where it will then go through McAfee's hook.

Mike Kwan
  • 24,123
  • 12
  • 63
  • 96
0

I've had to deal with something similar once. Read their own hook assembly stub, so you can figure out how to hook in a way you chain to their hook after yours.

Joshua
  • 40,822
  • 8
  • 72
  • 132
0

I'd imagine that McAfee are performing DLL injection from kernel-mode. They are likely finding the address of the KeServiceDescriptorTable (exported by NTOSKRNL on 32-bit systems and the address to it is leaked on 64-bit environments by KiSystemServiceRepeat -> close to KiSystemCall64 found by the IA32_LSTAR Model Specific Register) and then locating NtCreateThreadEx from the service table, or they're using KeInitializeApc and KeInsertQueueApc (both exported by NTOSKRNL) for APC injection (custom NtQueueApcThread wrapper). That would be logical considering they are a security vendor with a lot of resources, I doubt they'd be injecting from user-mode.

The likelihood is they are abusing PsSetCreateProcessNotifyRoutineEx or PsSetLoadImageNotifyRoutineEx to detect new process creation. The first one is not as good as the latter, the latter is better for filtering of NTDLL.DLL since it is the first module loaded into every single process, and signifies the process has actually started up properly and is just about ready to execute its own code (after the Windows module loads, and because McAfee will need to wait for Win32 modules like kernel32.dll to be loaded otherwise they'll crash the process if they use the Win32 API at all in their injected modules).

You can try intercepting LdrInitializeThunk or KiUserApcDispatcher, but honestly, there's not much you can do. McAfee will find a way to inject into your process no matter what you do, because they have control from kernel-mode. If you develop process protection via a variety of kernel-mode callbacks from a driver, they'll bypass it using non-exported routines located via pattern match scanning of ntoskrnl.exe, or exported routines which don't invoke the callback notification APIs. If you locally patch routines invoked for thread creation/APC locally in your own process when performed by a remote attacker, they'll find ways to prevent this and bypass it (e.g. patch the patched routines in the address space of your process back to the original, inject, then re-patch the bytes back).

You're playing with fire if you want to stop security software with the privileges McAfee has. It is similar to how Anti-Cheat cannot stop game hackers who have kernel-mode access, and go do drastic measures of even flagging Debug Mode/Test Mode enabled nowadays.

PspSetProcessPpmPolicy
  • 369
  • 2
  • 7