Injecting a DLL prior to process execution

Why inject a DLL?

Dll Injection is a well known technique and is most often used to perform some kind of API hooking. As soon as the dll has been injected into a remote process, hooking APIs or patching existing functionality is easy because everything happens inside one address space.
Apart from hooking APIs to change existing program logic, there are several other reasons why one would want to inject a dll into another process, especially in the field of Reverse Engineering.

Once injected one could

• perform complex IAT rebuilding by injecting code into a process
• allocate a console and printout parameters gained from hooking interesting API functions
• disable anti-debugging techniques used by the process by hooking some APIs and/or patching known memory locations
• implement a fast in-process debugger/tracer by catching exceptions via vectored exception handling
• ...

or just to execute any kind of code inside another process to do some fancy things.
After a process has been created, the process of injecting a dll is pretty straight forward - write some shellcode to the memory of the remote process and create a remote thread at that location to carry out the actual dll loading.
Depending on the goal which needs to be achieved, it can be a requirement to inject the respective dll as early as possible in the stage of process creation. Especially in the case where a dll would perform some countermeasures against anti-debugging techniques, it is crucial that control flow reaches the injected dll before any code of the process itself gets executed.

Early injection

The idea to force a process to load a dll before anything else is quite simple: create the process in suspended state and add another entry in the import descriptor table which references the dll to be injected. We can then resume the main thread, which has the effect that all dlls are loaded and finally control flow is dispatched to the applications entry point.
Here is how it works:

1. create the process in suspended state, i.e. the main thread is suspended before any code in the process has been executed and before any dll has been loaded.
2. Find the IMAGE_IMPORT_DESCRIPTOR table of the module and copy the existing table to a new location
3. Add a new IMAGE_IMPORT_DESCRIPTOR structure for every dll to be injected into the new table.
4. Fill OriginalFirstThunk as well as FirstThunk and the dll name field of the IMAGE_IMPORT_DESCRIPTOR structure
5. Finally, fix the RVA in the IMAGE_DATA_DIRECTORY to point to the new table and let the process continue execution

PE header with import table

Source code

C++ classes to perform injection prior to process creation as well as after the process has been started can be downloaded from the project site.
Besides, an IDA plugin - IDA Inject - implementing these techniques is available (requires IDA 5.x) and can be downloaded from this page.