0

I am messing around with dll injections. I am able to inject a dll with an exported function into some process, but I have a question now:

Is there a standard way to call the exported function of my injected dll?

I can provide code if necessary.

0

I am not sure if I understood correctly, but if you mean calling the exported function from the binary which just got injected the DLL, then do this:

auto hLib = GetModuleHandleA("your_library.dll");
auto fn = GetProcAddress(hLib, "exported_function_name");

// supposing your function is declared as:
// extern "C" __declspec(dllexport) int __cdecl fn() { ... }
((int(__cdecl*)(void)) fn)();

You might have to check which calling convention your compiler used for the function, though (if you didn't specify any).


Edit: since you want to call the function from the injector rather than the injected binary, you should do something like this:

  1. Use VirtualAllocEx to alloc some bytes in the target process
  2. Use WriteProcessMemory to write shellcode on the target process

    • You will need to write something like this:

      mov eax, 0x0BADC0DE ; the offset of your function
      call eax
      
    • You can use this online service to generate the shellcode.

  3. Use CreateRemoteThread to run a thread on the shellcode

Also, be aware that games usually have anti-cheat systems, and they detect this kind of behaviour (it's quite common).


But apart from all of this: you could inject your DLL with VirtualAllocEx -> WriteProcessMemory -> LoadLibrary | CreateRemoteThread, and have Windows call your DLL's DllMain instead of you doing it yourself.

  • sry for confusing you. I will explain: I am injecting my dll into the game with my exe and and want to call the exported function of my dll from my injector. I am trying to write a bot for myself and therefore the "gui" needs to call the injected dll – QDA Oct 9 '16 at 9:45
  • @QDA I updated my answer, please see if that's what you meant – Martin Oct 9 '16 at 14:28
  • if your DLLMain function contains everything that you need to do, then Martin's second suggestion is easiest. Use VirtualAllocEx to allocate memory in the remote process, WriteProcessMemory to write the DLL filename to that buffer, then CreateRemoteThread with the address of the LoadLibrary function, and passing the address of the buffer. Windows will create a thread which loads the DLL and runs your code. – peter ferrie Oct 14 '16 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.