Abstract: With the development of computer system and network technology, the technology of malicious code detection is facing new challenges, “DLL injection” is a common means of using malicious code to infect normal executable files. Based on the indepth understanding of the basic structure of PE files, this paper studies a technique for implementing DLL injection by manually modifying PE file, and proposes a method to detect the malicious injected DLL in the PE file. The method proposed has positive significance for research of DLL injection and detection.

Key words: malicious code, DLL injection, PE file, process, detection technology

关键词: 恶意代码, DLL注入, PE文件, 进程, 检测技术