2

I'm writing a DLL for a program that needs to run in an infinite loop (with delays, of course). For example:

while (true) {
    std::cout << "I am running.\n";
    Sleep(1000);
}

I'm not sure how but no matter how I do this, the target program closes itself after a couple minutes. I know that it is not the DLL's presence because if I don't have an infinite loop and it "completes" (but stays in memory) it doesn't detect anything.

I am using Cheat Engine to inject the DLL. It is detected both when I inject it normally and when I have the loop in a separate function and create a thread for it.

If there aren't a few easy and easy to patch ways to detect things like this, what are alternatives? I'm writing it as a DLL because I need to call functions within the process (CreateRemoteThread-ing the bases wouldn't be easy because most of them have many more than one argument).

Improve this question
4
  • Are you running this loop from dllmain?
    – Remko
    May 9, 2016 at 12:35
  • I've tried that and I've also tried having dllmain setup data and then using the "Create Thread" (couldn't be anything but direct CreateRemoteThread call) function on the base of a separate function with a loop in it.
    – Lupe
    May 9, 2016 at 12:52
  • Can you provide more information as to the program and what you're trying to do? It is very unclear.
    – tmr232
    May 25, 2016 at 5:53
  • Sorry, I agree my wording was unclear. I was wrong about the cause of the crash, which took me a long time to figure out because of an annoying exception handler. I'll leave this on hold (can't delete) because it isn't relevant and might be misleading.
    – Lupe
    May 25, 2016 at 6:35

1 Answer 1

Reset to default
2

Have you considered using the DLL only for providing "stub" methods, that you could call using CreateRemoteThread, and have the DLL methods transform the arguments into what the method you ultimately want to call takes?

I know this is not really a solution to how the program detects other threads running. But with some luck, the fact that your threads would only run for a fraction of a second under this proposal, it would be much less likely for the program to detect them.

Improve this answer
2
  • That's sort of what I ended up doing, except I don't use a DLL. I wrote an assembly script to handle the conventions I need and allocate & write it, then when I need to call a func I allocate & write a structure containing the convention, address, num of args, and args and pass a pointer to it as an arg to the function with CreateRemoteThread. Probably a lot harder than it has to be but it works, at least. Thanks
    – Lupe
    May 12, 2016 at 19:11
  • ...never mind. It still closes / crashes after about the same period of time. I really have no idea what's happening.
    – Lupe
    May 12, 2016 at 21:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.