2

I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example:

while (true) {
    std::cout << "I am running.\n";
    Sleep(1000);
}

I'm not sure how but no matter how I do this, the target program closes itself after a couple minutes. I know that it is not the DLL's presence because if I don't have an infinite loop and it "completes" (but stays in memory) it doesn't detect anything.

I am using Cheat Engine to inject the DLL. It is detected both when I inject it normally and when I have the loop in a separate function and create a thread for it.

If there aren't a few easy and easy to patch ways to detect things like this, what are alternatives? I'm writing it as a DLL because I need to call functions within the process (CreateRemoteThread-ing the bases wouldn't be easy because most of them have many more than one argument).

closed as unclear what you're asking by Jason Geffner, perror, peter ferrie, jvoisin, tmr232 May 25 '16 at 5:53

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Are you running this loop from dllmain? – Remko May 9 '16 at 12:35
  • I've tried that and I've also tried having dllmain setup data and then using the "Create Thread" (couldn't be anything but direct CreateRemoteThread call) function on the base of a separate function with a loop in it. – Lupe May 9 '16 at 12:52
  • Can you provide more information as to the program and what you're trying to do? It is very unclear. – tmr232 May 25 '16 at 5:53
  • Sorry, I agree my wording was unclear. I was wrong about the cause of the crash, which took me a long time to figure out because of an annoying exception handler. I'll leave this on hold (can't delete) because it isn't relevant and might be misleading. – Lupe May 25 '16 at 6:35
2

Have you considered using the DLL only for providing "stub" methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately want to call takes?

I know this is not really a solution to how the program detects other threads running. But with some luck, the fact that your threads would only run for a fraction of a second under this proposal, it would be much less likely for the program to detect them.

  • That's sort of what I ended up doing, except I don't use a DLL. I wrote an assembly script to handle the conventions I need and allocate & write it, then when I need to call a func I allocate & write a structure containing the convention, address, num of args, and args and pass a pointer to it as an arg to the function with CreateRemoteThread. Probably a lot harder than it has to be but it works, at least. Thanks – Lupe May 12 '16 at 19:11
  • ...never mind. It still closes / crashes after about the same period of time. I really have no idea what's happening. – Lupe May 12 '16 at 21:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.