摘要： 研究了如何将Windows环境下的动态链接库(DLL)技术与远程线程插入技术结合起来实现特洛伊木马植入的新方案。在该方案中,提出了特洛伊木马程序DLL模块化,并且创建了独立的特洛伊木马植入应用程序,由该植入程序实现从特洛伊木马程序中分离出来的植入功能。采用该方案实现的木马植入,具有很好的隐蔽性和灵活性。
关键词:
特洛伊木马,
DLL,
进程,
线程,
植入
Abstract: A new scheme is studied to realize the injection of Trojan horse by combining the technology of DLL(dynamic linking library) and that of remote thread injection on the Windows platform. The idea of replacing traditional Trojan horse program with Trojan horse DLL and the notion of creating single Trojan horse injection program to realize the special function of Trojan horse injection are proposed. It is rather safe and flexible to inject Trojan horse by adopting this scheme.
中图分类号:
潘勉,薛质,李建华,李生红. 基于DLL技术的特洛伊木马植入新方案[J]. , 2004, 30(18): 111-.
PAN Mian1,XUE Zhi1,LI Jianhua1,LI Shenghong2. New Scheme for the Injection of Trojan Horse Based on DLL[J]. , 2004, 30(18): 111-.