In Memory DLL Injection

Question

I am currently working on learning how different types of DLL injection can be performed. Right now I am able to run a function by:

1. Opening the remote process;
2. Allocating memory in remote process;
3. Relocating our image according to the address of allocated memory;
4. Using CreateRemoteThread() giving it the address of my declared function.

So, right now I am just executing a _MessageBox_ which is surely uninteresting. What I want to do right now is to execute a function which will load a DLL into its own address space and execute it, like how a traditional PE loader works. I took a reference code and tried but I am getting an access violation when I inspect using Olly.

Please tell me, is it even possible?

Answer 1

Aphex has demo's written in Delphi with a few code injection examples. Should compile with Delphi 2007...maybe even with Delphi 7.

• Remote Procedure Injection
• InjectLibrary
• InjectLibraryEx
• CreateProcessEx
• Inject Executable

Most examples rely on Aphex's AfxCodeHook library (with source), and this is where the heavy lifting is done. Even without a copy of Delphi, you can review this source to understand the techniques used.

Answer 2

Yes it is possible but to load a DLL into a process's own address space , what are you using?

You should use LoadLibrary("my.dll") for this case. Note that you dont need to use CreateRemoteThread() for this case.

Answer 3

Well as you already pointed out the usual process of a simple DLL injection is

1. Open the target process and aquire a handle
2. Allocate memory for your code
3. Create a thread which calls LoadLibrary with your payload library path as parameter
4. Close the target process

You said you already managed to create a thread and open a message box. To load your payload library you just need to call LoadLibrary instead of MessageBox.

That would be, in my opinion, the easiest way to inject a library into a process. However, sometimes you need to use a different technique since Anti Virus / Anti Cheat Software (depending on your work area) can block this method easily.

A more advanced method is Manual Mapping. Basically you are loading the payload library yourself, without the help of the operating system, and map it into the target process' memory. Instructions for this method can be found here.

Another little trick when working with low level Windows stuff is to take a look at the reactOS documentation. reactOS is a different operating system, but implements the Windows API. It's not garuanteed to be fully compatible but it should give you an idea how the functions are implemented.

For example, you can find the implementation of LoadLibrary here.

There are more ways to get your code into your target. Let your creativity run free.

By the way, a neat library I like to use for this tasks is BlackBone.