How to inject my dll into all user processes [Win]?

AppInit_DLLs based injection only works for executables linked with user32.dll:

hXXp://support.microsoft.com/kb/q197571/

Take a look into the source code at:

hxxp://iamaphex.net/downloads/
and
hxxp://www.rootkit.com (ring-3 rootkits)

Regards,
Opc0de

I was looking something similiar to LD_PRELOAD and I think the registry method is ok for me and I will check it.
I checked out the rest of the links/methods and I think I have idea how to make a thing I wanted to do.
Also I found out something usefull on MS site.

hxxp://research.microsoft.com/sn/detours/
..."Detours intercepts Win32 functions by re-writing target function images."...

I think the Registry is the best way to hide your DLL and also keep
it run (loaded) . if you put your dll in the following key (On Win NT) ,
ur dll would be loaded by Explorer during windows startup :-)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

Enjoy

PS : u should register the dll and puts the CLSID in ShellExecuteHooks.

Few things about the HKEY_LOCAL_MACHINE\Software\Microsoft
\Windows NT\CurrentVersion\Windows\AppInit_DLLs
method of Injecting a DLL.

Windows 98 will ignore this registry key, so you cannot use this technique under windows 98.

When you're adding dlls to the key, only the first dll can have a path name. All other paths will be ignored, so you should put your dll in the windows directory.

After you change the registry key, you must restart the machine so windows initializes and saves the value to the key. Then when the user32.dll is mapped into a process, it will call the dllmain of your dll with reason DLL_PROCESS_ATTACH so each library can initialize itself.

Because your injected dll is loaded early in the process's lifetime, you must excercise caution when calling functions.

Of all the methods for injecting dlls, this is the easiest.

---------------------------------------------------------

Some other ways that you might want to look into, whether you need it or not, it's still fun to learn: Injection through windows hooks, injection using remote threads, injection as debugger, memory mapped file, or createprocess.

Hope this helps people who are trying to learn dll injection with what to look for while searching.