AlexSyScan13

Surviving as an Injected DLL
■ DllMain is the only piece of code that will run while in the
hotpatching process
■ After it exits, the hotpatcher will try to find valid hotpatch data
(more on this later)
■ If no data is found, the thread is terminated and the DLL unloaded!
■ One should therefore:
■ Use CreateThread and/or the Vista Thread Pool API to spawn off a new
thread
■ Use LdrAddRefDll
■ Makes the DLL immune to the hotpatcher’s LdrUnloadDll
■ ~15 lines of code and you’ve got a universally loadable DLL
■ But it has to be on disk…