1

Not sure if the title is that telling but what I want to do is hack into an executable and do as little as necessary to get the code from my DLL running since I want to write as few lines of assembly code as possible.

I already have the place where I'd like to jump in and I am ready to insert the necessary assembly instructions into the executable using ollydbg but since I never did that before I'm afraid I need a little help on those last steps.

What I want to do is basically:

  1. Force the executable to load my DLL
  2. Push a few parameters onto the stack for init_my_dll()
  3. call init_dll()

but I'm not sure what's the best way to accomplish that. Is there a straight forward way to get this done?

Btw: Is what I'm doing here actually called "dll-injection"?

Improve this question
7
  • possible duplicate of reverseengineering.stackexchange.com/questions/2793/…
    – Martin
    Dec 5, 2016 at 23:02
  • But to answer your question - yes, what you're doing is called DLL / code injection, and what you want to do can be relatively easily achieved using Windows APIs (VirtualAllocEx -> CreateRemoteThread(..., LoadLibraryA, "your_dll.dll", ...)). You can do it yourself if you want, too (that's called manual mapping).
    – Martin
    Dec 5, 2016 at 23:08
  • This is "dll-injection". Like mentioned by Martin, just create a thread at the location of 'LoadLibraryA' with the library name. As for additional parameters, you should be able to mess with the stack.
    – Nordwald
    Dec 6, 2016 at 6:44
  • @Martin So the "easiest" way is to inject code into the executable which calls CreateRemoteThread() in order to load my dll, then call GetProcAddress() to get the address of init_my_dll() and call it? The link you are referring seems to do something different - if I get this right there are two processes in the end. I don't get how I would make the target process call init_my_dll() as described there.
    – Stefan Falk
    Dec 6, 2016 at 9:46
  • No - you don't use GetProcAddress to call your function. You use it to find LoadLibraryA, and call it. That function will load your DLL, and will call its DllMain - and that function could be calling your init_my_dll function. That said - if you're trying to do this with a game, be careful, those have anti-cheats which usually detect this technique and ban you.
    – Martin
    Dec 6, 2016 at 18:41

1 Answer 1

Reset to default
1

I ended up placing the required code in the executable:

00C0B500   68 B6B4C000      PUSH ForgedAl.00C0B4B6                    ; ASCII "lua-extension.dll"
00C0B505   FF15 88F4C000    CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar> ; kernel32.LoadLibraryA

00C0B50B   68 C9B4C000      PUSH ForgedAl.00C0B4C9                    ; ASCII "initialize"
00C0B510   50               PUSH EAX                                  ; push dll handle
00C0B511   FF15 8CF4C000    CALL DWORD PTR DS:[<&KERNEL32.GetProcAdd> ; kernel32.GetProcAddress

00C0B517   56               PUSH ESI                                  ; holds pointer to the struct I want to steal -> parameter of "initialize"
00C0B518   FFD0             CALL EAX                                  ; call "initialize"
00C0B51A   5E               POP ESI

00C0B51B  ^E9 6648D0FF      JMP ForgedAl.0090FD86                     ; jump back and continue original program flow
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.