2

I created a program that performs DLL injection. It does that by opening the process with OpenProcess, writes the DLL path to the process and creates a remote thread with CreateRemoteThread with the dll as a parameter.(The DLL just spawns a messagebox). It works just fine but the problem is the second time i can't see the messagebox. The functions OpenProcess, CreateRemoteThread, VirtualAllocEx, WriteProcessMemory all return true but i can't see the thread being created and the DLL does not run.

Thanks.

Improve this question
4
  • second time during the same run or another one?
    – Igor Skochinsky ♦
    Sep 1, 2017 at 8:23
  • second time i try to inject the same dll to the same process, the dll does not run @IgorSkochinsky
    – rustam Shirinov
    Sep 1, 2017 at 8:31
  • are you calling LoadLibrary in the injected thread?
    – Igor Skochinsky ♦
    Sep 1, 2017 at 8:32
  • yes i get a handle to the LoadLibrary function and pass it as a parameter to the CreateRemoteThread @IgorSkochinsky
    – rustam Shirinov
    Sep 1, 2017 at 9:19

1 Answer 1

Reset to default
1

Calling LoadLibrary twice with the same DLL name only increases the load counter but does not cause DLL entrypoint to be called again. From the doc (emphasis mine):

If the specified module is a DLL that is not already loaded for the calling process, the system calls the DLL's DllMain function with the DLL_PROCESS_ATTACH value. If DllMain returns TRUE, LoadLibrary returns a handle to the module. If DllMain returns FALSE, the system unloads the DLL from the process address space and LoadLibrary returns NULL. It is not safe to call LoadLibrary from DllMain. For more information, see the Remarks section in DllMain.

So if you need to execute your code again you'll have to do it explicitly, LoadLibrary won't do it for you.

EDIT:

One possible solution could be to use the address of the function in your (already loaded) DLL instead of LoadLibrary as the address of the second dinjected thread.

Improve this answer
3
  • I am sorry but i did not understand how exactly i am going to do it explicitly. This is the code: remote_dll_path= (LPVOID)VirtualAllocEx(hProcess, &RemoteAddress, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); WriteProcessMemory(hProcess, remote_dll_path, full_dll_path, size, NULL); hKernel32 = GetModuleHandleA("kernel32.dll"); LoadLibraryAddress = GetProcAddress(hKernel32, "LoadLibraryA"); CreateRemoteThread(hProcess, 0, 0, (LPTHREAD_START_ROUTINE)LoadLibraryAddress, remote_dll_path, 0, &threadId); VirtualFreeEx(hProcess, (LPVOID)remote_dll_path, size, MEM_DECOMMIT)
    – rustam Shirinov
    Sep 1, 2017 at 14:30
  • you'll need to add some shellcode which would call the necessary function from the DLL. Just LoadLibraryA by itself is not enough if you need to run it twice.
    – Igor Skochinsky ♦
    Sep 1, 2017 at 14:32
  • also see my edit.
    – Igor Skochinsky ♦
    Sep 1, 2017 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.