I am messing around with dll injections. I am able to inject a dll with an exported function into some process, but I have a question now:
Is there a standard way to call the exported function of my injected dll?
I can provide code if necessary.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityI am not sure if I understood correctly, but if you mean calling the exported function from the binary which just got injected the DLL, then do this:
auto hLib = GetModuleHandleA("your_library.dll");
auto fn = GetProcAddress(hLib, "exported_function_name");
// supposing your function is declared as:
// extern "C" __declspec(dllexport) int __cdecl fn() { ... }
((int(__cdecl*)(void)) fn)();
You might have to check which calling convention your compiler used for the function, though (if you didn't specify any).
Edit: since you want to call the function from the injector rather than the injected binary, you should do something like this:
VirtualAllocEx
to alloc some bytes in the target processUse WriteProcessMemory
to write shellcode on the target process
You will need to write something like this:
mov eax, 0x0BADC0DE ; the offset of your function
call eax
You can use this online service to generate the shellcode.
Use CreateRemoteThread
to run a thread on the shellcode
Also, be aware that games usually have anti-cheat systems, and they detect this kind of behaviour (it's quite common).
But apart from all of this: you could inject your DLL with VirtualAllocEx
-> WriteProcessMemory
-> LoadLibrary
| CreateRemoteThread
, and have Windows call your DLL's DllMain
instead of you doing it yourself.