0

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by:

  1. Opening the remote process;
  2. Allocating memory in remote process;
  3. Relocating our image according to the address of allocated memory;
  4. Using CreateRemoteThread() giving it the address of my declared function.

So, right now I am just executing a _MessageBox_ which is surely uninteresting. What I want to do right now is to execute a function which will load a DLL into its own address space and execute it, like how a traditional PE loader works. I took a reference code and tried but I am getting an access violation when I inspect using Olly.

Please tell me, is it even possible?

2

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7.

Most examples rely on Aphex's AfxCodeHook library (with source), and this is where the heavy lifting is done. Even without a copy of Delphi, you can review this source to understand the techniques used.

  • I came across some C# examples, they were always using an assembly stub routine to resolve dlls and DllMain function call stub. Why is that so? – ashish Aug 28 '17 at 17:49
  • I am not familiar with C# having the ability to call inline asm. Certainly possible in C/C++/Delphi. Can you link a specific example? – Mick Aug 28 '17 at 20:04
  • Please see here – ashish Aug 29 '17 at 14:26
  • 1
    Unlikely to be as easy on Windows 7 onwards, especially with the plethora of options that can be enabled to thwart certain exploit types (think EMET and friends). – 0xC0000022L Aug 30 '17 at 21:25
0

Yes it is possible but to load a DLL into a process's own address space , what are you using?

You should use LoadLibrary("my.dll") for this case. Note that you dont need to use CreateRemoteThread() for this case.

  • I imagine OP was asking about remotely injecting a DLL, not loading to it's own process. – NirIzr Aug 24 '17 at 8:12
  • From OP's ques: "What I want to do right now is to execute a function which will load a DLL into its own address space and execute it" – shaarang Aug 24 '17 at 8:13
  • Please read the entirety of OPs question, you'll see it clearly discusses DLL injections. – NirIzr Aug 24 '17 at 8:14
  • Yes I have read it completely, He initially did discuss DLL injection in a remote process but first he wants to know how to load a DLL in a normal process itself and which according to me he is correct in doing because first you should know how to load a dll normally in your own process then you can think about remotely injecting it! – shaarang Aug 24 '17 at 8:17
  • Please see the code I have written here – ashish Aug 24 '17 at 9:12
0

Well as you already pointed out the usual process of a simple DLL injection is

  1. Open the target process and aquire a handle
  2. Allocate memory for your code
  3. Create a thread which calls LoadLibrary with your payload library path as parameter
  4. Close the target process

You said you already managed to create a thread and open a message box. To load your payload library you just need to call LoadLibrary instead of MessageBox.

That would be, in my opinion, the easiest way to inject a library into a process. However, sometimes you need to use a different technique since Anti Virus / Anti Cheat Software (depending on your work area) can block this method easily.

A more advanced method is Manual Mapping. Basically you are loading the payload library yourself, without the help of the operating system, and map it into the target process' memory. Instructions for this method can be found here.

Another little trick when working with low level Windows stuff is to take a look at the reactOS documentation. reactOS is a different operating system, but implements the Windows API. It's not garuanteed to be fully compatible but it should give you an idea how the functions are implemented.

For example, you can find the implementation of LoadLibrary here.

There are more ways to get your code into your target. Let your creativity run free.

By the way, a neat library I like to use for this tasks is BlackBone.

  • Actually, I was trying to ManualMapping but it was not working in my case. As in manual map, we have to specify the function which will get executed and its size and the technique that most of the code found on the internet is same (subtracting an empty function defined just after our function) and it did not work. I manually wrote the size by making it a separate section using #pragma, but it also didn't seem to work. – ashish Aug 25 '17 at 12:35
  • And as I add LoadLibrary method just after the MessageBox API, the DLL gets loaded but as soon as it gets loaded the process exits. What can be the problem? – ashish Aug 25 '17 at 13:22
  • Do you create a new thread in your payload's DllMain? – Michael Pittino Aug 25 '17 at 20:08
  • Yes, I first write the payload code using WriteProcessMemory and then I use CreateRemoteThread giving it the payload address. – ashish Aug 26 '17 at 3:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.