お姉ちゃんの愛の注射器 Version 1.3.0 Beta (Build 20060608)
Program: http://mifan.infor.org/lab/dll_inj-1.3.0-beta.rar
Runtime Library: http://mifan.infor.org/lab/qt-mt321.rar
The most significant new feature of this version, 1.3.0, is no doubt that the DLL Injector can now access KAV (Kaspersky Anti-Virus) processes. But anyway, what's so important about Uncle Russian that it is taken as a milestone of my program? Well, KAV prevents other programs from accessing its processes by blocking the OpenProcess system call trying to attain its handles. KAV is definitely doing the right thing: to protect itself from virii and other malwares, as we already knew the fact that many virii nowadays would try to disable anti-virus softwares.
Neverthless, we still want the access to the KAV processes, and there's an interesting fact that captures my attention. Although we cannot terminate the process kav.exe directly, which runs as the login user, the operating system can do this when we logoff. This could mean that we can do something to attain the KAV processes' handles like the system does. Finally I found that handles of every running process were kept by a system process, csrss.exe, and, more surprisingly, they were opened with PROCESS_ALL_ACCESS flag and duplicable. By using Native API calls can we easily enumerate and duplicate those handles and thus access the KAV processes bypassing calling OpenProcess.
Thanks to Process Explorer from Sysinternals so that I can be able to discover handles opened by running processes.