0

Example:

I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow?

To what i'm going it's C++ on DLL injection...

I thought it was possible using CreateRemoteThread, but i don't know if it is necessary to pass the id of the thread.

  • You can use CreateRemoteThread but you'd need to make sure the function is a THREAD_START_ROUTINE. If not, make a stub for it. As for the thread: no, you don't (shouldn't) need anything like that. – Martin Dec 30 '16 at 13:05
  • This question is not really clear. Why do you no longer think using CreateRemoteThread is possible? – NirIzr Dec 31 '16 at 19:19
0

CreateRemoteThread() is used to create a new thread inside the remote process. The function will return the ID of the newly created thread. This can be used to load your DLL into the remote process, by passing the address of LoadLibrary() as the thread start address (note that you would need to VirtualAllocEx() and WriteProcessMemory() to place the filename in the remote process first).

Once your DLL is loaded, you would need to hook the function of interest (via VirtualProtect(MEM_WRITABLE)/memcpy()/VirtualProtect(original protection)), since you can't inject directly into a thread. You can only modify the code that the thread is running, and then receive control indirectly.

Note that for safety, you would need to SuspendThread() the thread of interest before you make changes to its code, unless the function that you wish to alter is hot-patchable. In the case of a hot-patchable function, you would write the long jump at address function-5, and then write the short jump at the function start. The write of the short jump is an atomic operation so there is no risk of misaligned execution.

  • this pass the thread local storage without problems? thanks. – nikomaster Jan 14 '17 at 19:31
  • yes, Thread Local Storage will still behave correctly. – peter ferrie Jan 20 '17 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.