blocks|key|1130508|text|实现DLL注入(挂钩)的场景很多，BTW，您必须更多地了解每种方法背后的内容是如何工作的，最常见的是使用CreateRemoteThread()+API函数，然后必须在每个进程上注入您的安全DLL，并对CreateRemoteThread()或任何“危险”API调用进行钩子/重定向/拒绝任何调用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1130509|PS:但是你要记住：|1130510|用户模式挂钩绝不能成为以任何安全方式应用附加安全检查的选项。如果您只想“沙箱”一个专门的进程，您非常了解，而且流程实际上不知道EasyHook，这可能会成功！但千万不要试图编写任何基于用户模式挂钩的安全软件。这没用的，我向你保证，…|blockquote|1130511|1130512|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|L|8|@]|9|@]|A|$]]|$1|G|3|-4|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

There are many scenario to achieve DLL injection(Hooking), BTW, you must learn more about how stuff works behind every method, the most common one is by using CreateRemoteThread() API function, then you must to inject your security DLL on every process and hook/redirect/deny any call to CreateRemoteThread() or any "dangerous" API call.

PS: BUT keep in your mind:

<blockquote>
 user-mode hooking can NEVER be an option to apply additional security
 checks in any safe manner. If you only want 
 to “sandbox” a dedicated process, you know well about, and the process in fact doesn’t know about 
 EasyHook, this might succeed! But don’t ever attempt to write any security software based on user 
 mode hooking. It won’t work, I promise you…
</blockquote>

blocks|key|1027896|text|你有两个选择。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1027897|为您的进程添加一个排除项，这样McAfee就不会试图扫描它。我不使用McAfee的产品，但我假设这是一个相对简单的过程。|ordered-list-item|1027898|卸载McAfee|1027899|1027900|1027901|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$]]|$1|E|3|F|5|D|7|M|8|@]|9|@]|A|$]]|$1|G|3|-4|5|6|7|N|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|O|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|P|8|@]|9|@]|A|$]]]|J|$]]

You have 2 options.

<ol>
<li>Add an exclusion for your process so that McAfee doesn't attempt to scan it. I don't use McAfee's products, but I would assume that this would be a relatively straightforward process.</li>
<li>Uninstall McAfee</li>
</ol>

blocks|key|1027903|text|最简单的解决方案就是解除受影响的函数。我不得不做同样的工作，围绕戴尔的一些crapware。尽管它需要对x86程序集有一定的理解，但它并不太难。您必须禁用DEP，使补丁代码可写，找到原始说明，并将它们复制回来。找到原始指令可能意味着拆卸修补程序。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1027904|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

The easiest solution is to just unhook the affected functions. I had to do the same to work around some Dell crapware. It's not excessively hard, even though it requires some understanding of x86 assembly. You have to disable DEP, make the patched code writeable, find the original instructions, and copy them back. Finding the original instructions probably means disassembling the patch.

blocks|key|1332912|text|另一种选择是简单地把它挂在另一个地方。例如，将IAT挂起，然后当您完成任何您想要的操作时，将执行转发回真正的函数，然后它将通过McAfee的钩子。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1332913|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Another alternative is simply to hook it at a different place. For example, hook the IAT instead and then when you are done with whatever you want, forward execution back to the real function where it will then go through McAfee's hook.

blocks|key|1333013|text|我曾经不得不处理类似的事情。阅读他们自己的钩子组装存根，这样你就可以知道如何用链子连接到他们的钩子上。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1333014|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I've had to deal with something similar once. Read their own hook assembly stub, so you can figure out how to hook in a way you chain to their hook after yours.

blocks|key|1130572|text|我可以想象，McAfee正在从内核模式执行DLL注入.他们可能会找到KeServiceDescriptorTable的地址(在32位系统上由NTOSKRNL导出，该地址在64位环境中被KiSystemServiceRepeat+->泄露，接近IA32_LSTAR模型特定寄存器找到的KiSystemCall64+)，然后从服务表中定位NtCreateThreadEx，或者使用KeInitializeApc和KeInsertQueueApc+(都由NTOSKRNL导出)进行APC注入(自定义NtQueueApcThread包装)。考虑到他们是一个拥有大量资源的安全供应商，这是合乎逻辑的，我怀疑他们是否会从用户模式中注入。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1130573|很可能他们滥用PsSetCreateProcessNotifyRoutineEx或PsSetLoadImageNotifyRoutineEx来检测新的进程创建。第一个模块不如后者，后者更适合过滤NTDLL.DLL，因为它是加载到每个进程中的第一个模块，表明进程实际上已经正确启动，并且已经准备好执行自己的代码(在McAfee模块加载之后，因为McAfee需要等待内核32.dll这样的Win32模块加载，否则，如果它们在注入的模块中完全使用Win32+API，就会导致进程崩溃)。|1130574|您可以尝试拦截LdrInitializeThunk或KiUserApcDispatcher，但老实说，您无能为力。无论您做什么，McAfee都会找到一种注入到进程中的方法，因为它们可以通过内核模式进行控制。如果您通过驱动程序的各种内核模式回调来开发进程保护，他们将使用通过ntoskrnl.exe模式匹配扫描定位的非导出例程来绕过它，或者使用不调用回调通知API的导出例程。如果您在自己的进程中执行远程攻击者执行时在本地调用用于线程创建/APC的本地补丁例程，它们将找到防止这种情况的方法并绕过它(例如，将进程地址空间中的修补例程修补回原来的位置，注入，然后重新补回字节)。|1130575|如果你想用McAfee拥有的特权停止安全软件，你就在玩火。这类似于反欺骗无法阻止游戏黑客谁有内核模式访问，并去采取激烈的措施，甚至标记调试模式/测试模式启用当今。|1130576|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

I'd imagine that McAfee are performing DLL injection from kernel-mode. They are likely finding the address of the KeServiceDescriptorTable (exported by NTOSKRNL on 32-bit systems and the address to it is leaked on 64-bit environments by KiSystemServiceRepeat -> close to KiSystemCall64 found by the IA32_LSTAR Model Specific Register) and then locating NtCreateThreadEx from the service table, or they're using KeInitializeApc and KeInsertQueueApc (both exported by NTOSKRNL) for APC injection (custom NtQueueApcThread wrapper). That would be logical considering they are a security vendor with a lot of resources, I doubt they'd be injecting from user-mode.

The likelihood is they are abusing PsSetCreateProcessNotifyRoutineEx or PsSetLoadImageNotifyRoutineEx to detect new process creation. The first one is not as good as the latter, the latter is better for filtering of NTDLL.DLL since it is the first module loaded into every single process, and signifies the process has actually started up properly and is just about ready to execute its own code (after the Windows module loads, and because McAfee will need to wait for Win32 modules like kernel32.dll to be loaded otherwise they'll crash the process if they use the Win32 API at all in their injected modules).

You can try intercepting LdrInitializeThunk or KiUserApcDispatcher, but honestly, there's not much you can do. McAfee will find a way to inject into your process no matter what you do, because they have control from kernel-mode. If you develop process protection via a variety of kernel-mode callbacks from a driver, they'll bypass it using non-exported routines located via pattern match scanning of ntoskrnl.exe, or exported routines which don't invoke the callback notification APIs. If you locally patch routines invoked for thread creation/APC locally in your own process when performed by a remote attacker, they'll find ways to prevent this and bypass it (e.g. patch the patched routines in the address space of your process back to the original, inject, then re-patch the bytes back).

You're playing with fire if you want to stop security software with the privileges McAfee has. It is similar to how Anti-Cheat cannot stop game hackers who have kernel-mode access, and go do drastic measures of even flagging Debug Mode/Test Mode enabled nowadays.

I have a process that doing some inline hooks on WinSock module (Send and Receive functions).
On a machine with McAfee I can see that two dlls are being injected into my process:

<ul>
<li>hipi.dll</li>
<li>hipqa.dll</li>
</ul>

Both are also doing probably inline hooking on those functions and I get collisions and unwanted behaviors. Is there an option to prevent/unload those dlls so they will not interfere?

10x,
Guy

Prevent McAfee Dlls injection

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云AI代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

功能1上新10个字符

功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符功能2描述100个字符。

功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符功能2上新100个字符。

功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符功能5描述100个字符

功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符功能5上新100个字符

功能4上新

文章&问答评论现已支持表情

全新交互，全新视觉，新增快捷键、悬浮工具栏、高亮块等功能并同时优化现有功能，全面提升创作效率和体验

社区富文本编辑器全新改版！诚邀体验～ 

精选全网热门MCP server，让你的AI更好用 🚀

💥开发者 MCP广场重磅上线！

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我有一个在WinSock模块(发送和接收函数)上执行一些内联钩子的过程。在一台带有McAfee的机器上，我可以看到有两个dll被注入到我的进程中：hipi.dllhipqa.dll这两种方法都可能在这些函数上进行内联连接，而我也会遇到冲突和不想要的行为。是否有防止/卸载这些dll的选项，这样它们就不会发生干扰？10倍，盖伊

问防止McAfee Dlls注射
EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问防止McAfee Dlls注射EN

回答 6

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问防止McAfee Dlls注射
EN