Questions tagged [dll-injection]

DLL Injection is a method of code injection in a Microsoft Windows environment.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Windows Library description number

Windows Libraries that engage in Library Hijacking, typically have a number in their library description field. What is this field? How does Windows Process it and is there a mapping of int32-like ...
melsk's user avatar
  • 1
4 votes
2 answers
647 views

Forcing a legacy Windows application to use an older version of ntdll.dll

There is this old Windows application I've been using for more than a decade now: DesktopEarth. It got its last update in 2015 and the author's website is offline now, but it's been running fine on ...
klamann's user avatar
  • 141
2 votes
0 answers
154 views

Find an address of injected code via GetModuleHandleA

I am reversing really old game (20 years old). l2.exe loads Dsetup.dll Network.dll. (not sure about order) inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
Vetal.lebed's user avatar
2 votes
0 answers
59 views

Reversing internal function, can't call it with injected DLL

I'm currently learning RE. I've chosen to do so by trying to RE Skyrim for PC. I'm trying to call the ingame function for printing to the console, I'm doing this via an Injected DLL. The function call ...
Tom James's user avatar
1 vote
1 answer
455 views

How to debug a malware that does DLL injection into explorer.exe?

What steps would you suggest for debugging a malware that injects a DLL into explorer.exe? using X32dbg have already attached explorer.exe to x32dbg
purple.jar's user avatar
0 votes
1 answer
121 views

How to detect incorrectly named DLL?

I am trying a simple lab on malware analysis and we were given both an .exe and .dll file. However, I am told that the DLL will need to be renamed to something for it to work. How do I go about ...
Iva l's user avatar
  • 1
2 votes
0 answers
179 views

Call function from dll

I am writing a program and I have injected "mydll" file into the program, but I cannot call the hello function in it. How can I call the hello function? My code: import os from ctypes import ...
Furkan125's user avatar
1 vote
1 answer
635 views

How to extract specific data from memory

I'm totally new to this reverse engineering stuff. I'm working on my own project and trying to parse poker games from PokerStars application. I have already done with injecting my DLL to the app, but ...
Euler-Maskerony's user avatar
2 votes
1 answer
504 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
Irbis77's user avatar
  • 326
0 votes
1 answer
301 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
Irbis77's user avatar
  • 326
1 vote
1 answer
155 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
Irbis77's user avatar
  • 326
1 vote
1 answer
1k views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
Irbis77's user avatar
  • 326
3 votes
1 answer
2k views

Why address space is different for Ghidra, IDA and xDebug runtime and which one to use?

I have opened an executable with Ghidra, IDA and x64dbg (runtime). It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra. When hooking through ...
Irbis77's user avatar
  • 326
0 votes
1 answer
152 views

How to call your version of the existing function using proxy dll?

I have bits of code which decompiles a small part of the existing program. I have added it to the proxy dll. The code to the existing functions is hooked through Detour and looks like below (gui.h and ...
Irbis77's user avatar
  • 326
0 votes
1 answer
382 views

Proxy dll doesn't load the original dll

I have relatively simple code here for the proxy DllMain() function: BOOL APIENTRY DllMain(HMODULE hDll, DWORD reason, LPVOID reserved) { if (reason != DLL_PROCESS_ATTACH) { return TRUE; } ...
Irbis77's user avatar
  • 326
0 votes
1 answer
88 views

Modify main function for C++ game file

I am trying to modify the main function for a specific decompiled .exe. More specifically, I want to remove the reference to GUI from that .exe file, so that GUI doesn't get initialised on the startup ...
Irbis77's user avatar
  • 326
2 votes
3 answers
2k views

How can I view the output of printf calls without a console window?

I'm using IDA to poke around in an old video game and noticed there are lots of calls to the printf function: I can see in another function that dword_5CE914 is a bitmask comprising various startup ...
user7290573's user avatar
0 votes
1 answer
331 views

Modifying program using IDA/Hexrays decompilation pseudocode

A bit long-winded, apologies in advance. Updates to the question are at the end. I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
daedsidog's user avatar
1 vote
1 answer
285 views

Why does reflective dll injection need to perform loading in the target process?

I'm not sure i understand reflective loading. An injector process allocates memory in the target, writes a stub and the dll binary to be loaded, and the stub calls ReflectiveLoad in that binary. ...
Ref loader's user avatar
1 vote
1 answer
598 views

Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)

I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
桂冠-'s user avatar
  • 13
0 votes
1 answer
290 views

Call libc functions from the payload statically injected into ELF binary

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here. Now I would like to make it ...
Nazar Pasternak's user avatar
2 votes
1 answer
414 views

Are offsets within a loaded dll always the same relative to each other?

If I load a dll in 2 different processes, will the offsets calculations within one process hold for the other process? I'm currently trying to patch the import table of a dll, once injected into a ...
Eric's user avatar
  • 439
1 vote
0 answers
168 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...
user3449922's user avatar
1 vote
0 answers
158 views

A way to detect a anti-cheating system

I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script: debugProcess() -- Attach ...
user3449922's user avatar
0 votes
0 answers
220 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
user3449922's user avatar
0 votes
1 answer
762 views

best approach to hook function

I have found 2 source code example to hook a function. Example1: #include "detours.h" #include "sigscan.h" // this is the function that the program // will jump to when sum() is ...
user3449922's user avatar
0 votes
0 answers
503 views

DLL injection (Failed to inject)

I have found this complete and easy example to test the function hook: https://github.com/Zer0Mem0ry/Detour #include <Windows.h> #include <iostream> #include "detours.h" #...
user3449922's user avatar
2 votes
1 answer
1k views

dll injection (assembly code)

I need some tip to undrestand what is the best way to execute external code from DLL or command line. I like to add the force feedback support to different games that not support it. I can write a DLL ...
user3449922's user avatar
1 vote
0 answers
138 views

what are modern hooking techniques? [closed]

i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
beginner's user avatar
2 votes
2 answers
721 views

How to decompile "call eax" in IDA Pro?

I know that there is a similar question but the answers didn't provide any fix for that problem. I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
xxd's user avatar
  • 23
0 votes
1 answer
984 views

Loading a PE32 executable DLL Intel 80386 into a c# program

I'm new here so I'm sorry if this isn't the right section for my question. I'm reverse engineering a software that's written in .net 3.5 c# which loads a weird dynamic dll, which has an important ...
Hassan Abdul-Kareem's user avatar
1 vote
2 answers
273 views

advapi32.dll changes name of function during forwarding of exports

I'm trying myself at writing a manual mapper, for injection of DLLs into other processes. I've come to the point, where I've written a simple "Hello World" .dll, that I'm trying to inject ...
Burgesstorm's user avatar
0 votes
1 answer
114 views

Get string from function and pass it to another program

I want to make a small tool that analyzes text from console in online game and I'm stuck at reading a string from a function and sending it to another program. I managed to find function that takes ...
Dasmitian's user avatar
2 votes
1 answer
425 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
turtle's user avatar
  • 21
1 vote
2 answers
438 views

learning detour and code injection

i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field. i was wondering, since ...
newB's user avatar
  • 19
0 votes
1 answer
308 views

Can't find injected DLL in OllyDbg

I am trying to learn about injecting a DLL into a process and I wanted to simply execute a code which injects an already built DLL so that I could then check with OllyDbg if it worked. I am using the ...
Radu's user avatar
  • 103
0 votes
1 answer
270 views

Function Hooking via Dll Injection Negative Offset

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
user192148's user avatar
0 votes
1 answer
226 views

Writing a DLL in C# vs C++? [closed]

I am trying to make a client-sided anticheat which would work similar to BattlEye or GameGuard. In order to do this, I want to create a DLL which would do the cheat verification, which then I would ...
Radu's user avatar
  • 103
1 vote
0 answers
676 views

injecting through APC using LdrLoadDll fails on `CiValidateImageHeader`

I've encountered an image validation error while trying to inject dll from driver which add apc task to be performed by alertable thread. the function task include calling to LdrLoadDll with the ...
Zohar81's user avatar
  • 293
5 votes
1 answer
1k views

Microsoft Edge and it's related processes may have turned protected in windows 10 1903

It seems like driver based injection using APC calls fails on MicrosoftEdge and it's related processes (browser_broker.exe , MicrosoftEdgeCP.exe and MicrosoftEdge.exe). Looking into the problem, it ...
Zohar81's user avatar
  • 293
3 votes
1 answer
593 views

DLL Injection Call Address In Target

I have an address that is located in a dll loaded by my target process. I would like to call this address using dll injection. For now my dll looks like this: BOOL APIENTRY DllMain(HMODULE hModule, ...
Kevin Mueller's user avatar
1 vote
1 answer
369 views

Is it possible to hijack a C++ DLL after it has been loaded into the memory space? How?

I have a .Net application, in which a C++ DLL is embedded as a resource into the application. When the .Net application is running, I will extract the C++ DLL to a temporary folder, and after that, ...
Graviton's user avatar
  • 133
1 vote
0 answers
370 views

Detouring with Unreal Engine 4, importing exe functions

I'm not sure that this is the right SO community to be asking this in, but I thought I'd give it a try. Some friends and I have successfully detoured a game built with UE4 by loading a modified ...
Braaedy's user avatar
  • 111
3 votes
2 answers
2k views

Permanently load a DLL to an executable

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger. I've learnt that ...
George D's user avatar
1 vote
2 answers
1k views

Finding lua C functions compiled binary

So i am trying to "hack" a game however not for cheating purposes. I am looking to extend the games scripting functionality through a DLL that can look for processes and return them. The game I am ...
DanH50049's user avatar
0 votes
1 answer
1k views

Calling internal functions via dll injection - runtime error

I am trying to modify closed source game client that works with my game server. The purpose of that is being able to add new graphical elements into the client. I have read a lot of tutorials about ...
Piodo's user avatar
  • 109
2 votes
1 answer
1k views

DLL Injection does not work twice

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the ...
rustam Shirinov's user avatar
0 votes
3 answers
2k views

In Memory DLL Injection

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by: Opening the remote process; Allocating memory in remote process; ...
ashish's user avatar
  • 23
1 vote
1 answer
685 views

Unable to call function with CreateRemoteThread

I am messing around with some dll injection/code injection. Therefore I made a little program which does nothing, but it has a function in it, which never get called and I wrote another program which ...
Peter's user avatar
  • 11
0 votes
1 answer
810 views

It's possible call a function outside a original thread?

Example: I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow? To what i'm going ...
MindLerp's user avatar
  • 197