DLL Injection fails with code 127

问题

I am trying to do some dll injection. I think I tried everything I could but cound not solve the problem unfortunately. I always get ERROR CODE 127 which means ERROR_PROC_NOT_FOUND. I am using Windows 7 64 bit.

#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>

using namespace std;

char FileToInject[] = "theDll.dll";
char ProcessName[] = "calc.exe";

typedef HINSTANCE (*fpLoadLibrary)(char*);

bool InjectDLL(DWORD processId);

int main() {
    DWORD processId = NULL;

    PROCESSENTRY32 pre32 = {sizeof(PROCESSENTRY32)};
    HANDLE hProcSnap;
    cout << "BEFORECreateToolhelo32Snapshot:" << GetLastError() <<endl;
    while(!processId) {

            system("CLS");
            cout << "Searching..." << endl;
            hProcSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
            cout << "CreateToolhelo32Snapshot:" << GetLastError() <<endl;

            if(Process32First(hProcSnap, &pre32)) {

                    do {

                        if(!(strcmp(pre32.szExeFile, ProcessName))) {

                           processId = pre32.th32ProcessID;
                           break;

                        }

                    }
                    while(Process32Next(hProcSnap, &pre32));
            }
            Sleep(1000);
    }
    cout << GetLastError() <<endl;
    while(!InjectDLL(processId)) {
        cout << "DLL Injection failed" << endl;
        Sleep(1000);
    }

    cout << "DLL Injected successfully" << endl;
    getchar();
    CloseHandle(hProcSnap);

    return 0;
}

bool InjectDLL(DWORD processId) {

    HANDLE hProc;
    LPVOID paramAddr;
    cout << "START:" << GetLastError() <<endl;
    HINSTANCE hDll = LoadLibrary("KERNEL32");
    cout << "LoadLibrary:" << GetLastError() <<endl;

    fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");
    cout << "LoadLibraryArr:" << GetLastError() <<endl;
    hProc = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
    cout << "OpenProcess:" << GetLastError() <<endl;
    char DllPath[250] = "C:\\Hacks\test.dll";

    paramAddr = VirtualAllocEx(hProc, 0, strlen(DllPath) + 1, MEM_COMMIT, PAGE_READWRITE);
    cout << "VirtualAlloxEx:" <<GetLastError() <<endl;
    bool MemoryWritten = WriteProcessMemory(hProc, paramAddr, DllPath, strlen(DllPath) + 1, NULL);
    cout << "WriteProcessMemory:" << GetLastError() <<endl;
    CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryAddr, paramAddr, 0, 0);
    cout << "CreateRemoteThread:" <<GetLastError() <<endl;
    CloseHandle(hProc);
    return MemoryWritten;
}

The output is the following:

Searching...
CreateToolhelp32Snapshot: 18 ERROR_NO_MORE_FILES
LoadLibrary:18 ERROR_NO_MORE_FILES
LoadLibraryArr:127 ERROR_PROC_NOT_FOUND
OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND
CreateRemoteThread:5 ACCESS DENIED
DLL Injected successfully

The program finds the calc.exe as a process with no problem, but after that something goes wrong. Could someone please help me with this?

Thank you,

Tamas

回答1:

This is one problem:

char DllPath[250] = "C:\\Hacks\test.dll";

The last backslash is not escaped. Change to:

char DllPath[250] = "C:\\Hacks\\test.dll";

The function is called LoadLibraryA(), not LibraryLoadA():

fpLoadLibrary LoadLibraryAddr =
    (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

A few other suggestions:

Only check GetLastError() if the previous WINAPI function failed.
Only continue processing if the previous WINAPI code (or other code) succeeded.

回答2:

fpLoadLibrary LoadLibraryAddr = (fpLoadLibrary)GetProcAddress(hDll, "LibraryLoadA");

you should rather resolve the string LoadLibraryA. The

OpenProcess:127 ERROR_PROC_NOT_FOUND
VirtualAlloxEx:127 ERROR_PROC_NOT_FOUND (<-- sic)
WriteProcessMemory:127 ERROR_PROC_NOT_FOUND

errors are caused because you're using GetLastError even though these functions maybe didn't even fail. So before calling GetLastError, make sure that these functions yield an error return value (NULL or the like).

来源：https://stackoverflow.com/questions/12138841/dll-injection-fails-with-code-127

标签

c++

winapi

dll

code-injection