Call function of injected dll

Question

I am messing around with dll injections. I am able to inject a dll with an exported function into some process, but I have a question now:

Is there a standard way to call the exported function of my injected dll?

I can provide code if necessary.

Answer 1

I am not sure if I understood correctly, but if you mean calling the exported function from the binary which just got injected the DLL, then do this:

auto hLib = GetModuleHandleA("your_library.dll");
auto fn = GetProcAddress(hLib, "exported_function_name");

// supposing your function is declared as:
// extern "C" __declspec(dllexport) int __cdecl fn() { ... }
((int(__cdecl*)(void)) fn)();

You might have to check which calling convention your compiler used for the function, though (if you didn't specify any).

---

Edit: since you want to call the function from the injector rather than the injected binary, you should do something like this:

1. Use VirtualAllocEx to alloc some bytes in the target process

2. Use WriteProcessMemory to write shellcode on the target process

   • You will need to write something like this:

     mov eax, 0x0BADC0DE ; the offset of your function
     call eax
     

   • You can use this online service to generate the shellcode.

3. Use CreateRemoteThread to run a thread on the shellcode

Also, be aware that games usually have anti-cheat systems, and they detect this kind of behaviour (it's quite common).

---

But apart from all of this: you could inject your DLL with VirtualAllocEx -> WriteProcessMemory -> LoadLibrary | CreateRemoteThread, and have Windows call your DLL's DllMain instead of you doing it yourself.