Learning Malware Analysis

2.8 DLL Search Order Hijacking

When a process is executed, its associated DLLs are loaded into the process memory (either via an import table or as a result of the process calling the LoadLibrary() API). The Windows operating system searches for the DLL to be loaded in a specific order in the predefined locations. The search order sequence is documented in the MSDN here: http://msdn.microsoft.com/en-us/library/ms682586(VS.85).aspx.

In short, if any DLL has to be loaded, the operating system first checks if the DLL is already loaded in the memory. If yes, it uses the loaded DLL. If not, it checks if the DLL is defined in the KnownDLLs registry key (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs). The DLLs listed ...