Windows DLL injector in C doesn't inject the DLL

问题

I am trying to write a DLL injector to perform a DLL injector on a calculator process.

I wrote the DLL injector program in C and the DLL but the injector dosent inject the DLL or any other DLL (I tried to take some random windows DLL that the calculator doesn't use).

#include <stdio.h>
#include <Windows.h>

int main() {
    LPCSTR dllpath = "C:\\Users\\......\\Dll1.dll";
    printf("#### Starting ####\n");

    printf("step 1: attaching the target process memory\n");
    HANDLE hProcess = OpenProcess( 
        PROCESS_ALL_ACCESS, 
        FALSE, 
        6456 // target process id
    );
    if (hProcess != NULL) {
        printf("step 2: allocate the target memory process\n");
        LPVOID dllPathMemoryAddr = VirtualAllocEx(
            hProcess, 
            NULL, 
            strlen(dllpath), 
            MEM_RESERVE | MEM_COMMIT, 
            PAGE_EXECUTE_READWRITE 
        );
        if (dllPathMemoryAddr != NULL) {
            printf("step 3: write to the process memory\n");
            BOOL succeededWriting = WriteProcessMemory(
                hProcess, 
                dllPathMemoryAddr,  
                dllpath, 
                strlen(dllpath), 
                NULL 
            );

            if (succeededWriting) {
                printf("step 4: execute.\n");
                FARPROC loadLibAddr = GetProcAddress(
                    GetModuleHandle(TEXT("kernel32.dll")),
                    "LoadLibraryA" 
                );
                HANDLE rThread = CreateRemoteThread( 
                    hProcess, 
                    NULL, 
                    0, 
                     (LPTHREAD_START_ROUTINE)loadLibAddr,
                    dllPathMemoryAddr,
                    0,
                    NULL
                );
            }
        }
        CloseHandle(hProcess);
    }
    return TRUE;
}

after running the injector I get this output:

#### Starting ####
step 1: attaching the target process memory
step 2: allocate the target memory process
step 3: write to the process memory
step 4: execute.

after that, I am still unable to see in process explorer the new DLL.

回答1:

You are calling GetProcAddress() to get the address of LoadLibraryA(), this is returning the address of LoadLibraryA in your local process not the injected one. This is not guaranteed to be correct in the external process. You do not need to get the address manually, CreateRemoteThread will resolve the address for you.

Here is a very simple injector example that will explain how to do it

#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>

DWORD GetPid(char * targetProcess)
{
    HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (snap && snap != INVALID_HANDLE_VALUE)
    {
        PROCESSENTRY32 pe;
        pe.dwSize = sizeof(pe);
        if (Process32First(snap, &pe))
        {
            do
            {
                if (!_stricmp(pe.szExeFile, targetProcess))
                {
                    CloseHandle(snap);
                    return pe.th32ProcessID;
                }
            } while (Process32Next(snap, &pe));
        }
    }
    return 0;
}

int main()
{
    char * dllpath = "C:\\Users\\me\\Desktop\\dll.dll";
    char * processToInject = "csgo.exe";
    long pid = 0;
    while (!pid)
    {
        pid = GetPid(processToInject);
        Sleep(10);
    }

    HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
    if (hProc && hProc != INVALID_HANDLE_VALUE)
    {
            void * loc = VirtualAllocEx(hProc, 0, MAX_PATH, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
            WriteProcessMemory(hProc, loc, dllpath, strlen(dllpath) + 1, 0);       
            HANDLE hThread = CreateRemoteThread(hProc, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryA, loc, 0, 0);
            CloseHandle(hThread);
    }

    CloseHandle(hProc);
    return 0;
}

回答2:

I found the problem. I compiled the DLL as 64 but accidentally compiled the DLL injector has complied as 32 bit.

来源：https://stackoverflow.com/questions/59524224/windows-dll-injector-in-c-doesnt-inject-the-dll

标签

dll-injection