Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

Question

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table.

When I'm testing my solution in Windows 10 environment it works fine. Exe is injected and it runs properly, and shows me message box.

But when I'm trying to do the same on Windows 7 64bit (loader, payload and target are compiled as x86 code), I have an error:

Access violation executing location 0x7698FD1E

I checked, and this address is an MessageBoxA function's address from user32.dll library

Here is my main code to inject pe to remote process:

char* target_n = "InjectTarget.exe";
    char* payload_path  = "C:\\Users\\pb\\source\\repos\\pe-dumper\\Debug\\DummyApp.exe";

    FILE* raw_payload = get_file_buffer(payload_path);
    PIMAGE_NT_HEADERS inth = get_nt_headers(raw_payload);

    DWORD kImageSize = inth->OptionalHeader.SizeOfImage;
    DWORD kTargetProcId = get_process_id(target_n);

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, kTargetProcId);
    if (hProcess == NULL) {
        printf("Error: Process handle is NULL\n");
    }

    LPVOID imageBaseRemote = VirtualAllocEx(hProcess, NULL, kImageSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    if (imageBaseRemote == NULL) {
        printf("Error: Image base remote is NULL\n");
    }

    LPVOID imageBaseLocal = VirtualAlloc(NULL, kImageSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    copy_raw_to_image_local(imageBaseLocal, raw_payload);
    adjust_relocations(imageBaseRemote, imageBaseLocal);
    adjust_imports(imageBaseLocal);

    DWORD bytesWritten;
    if (!WriteProcessMemory(hProcess, imageBaseRemote, imageBaseLocal, kImageSize, &bytesWritten)) {
        printf("Cannot write to remote process!\n");
    }

    LPTHREAD_START_ROUTINE routine = ((ULONG_PTR)imageBaseRemote + inth->OptionalHeader.AddressOfEntryPoint);

    DWORD threadId;
    HANDLE hThread = CreateRemoteThread(hProcess, NULL, NULL, routine, NULL, NULL, &threadId);

    if (hThread == NULL) {
        printf("%d", GetLastError());
    }

    VirtualFree(imageBaseLocal, kImageSize, MEM_RELEASE);
    fclose(raw_payload);

Why these differences between windows 10 and windows 7 appears?

Answer 1

This is a very interesting try.

1. Are you sure that DummyApp and InjectTarget are both 32 bit exe?

2. I saw you launched a thread from entrypoint of DummyApp, but you should know entry point is not a real starting point while launching exe.

Before go to entry point, automatically dlls in import table will be loaded. Furthermore, not only dlls in import table, but another dlls are loaded while exe is executing.

So I think that the list of loading dlls might NOT be same in between win7 and win10.

I hope my opinion is helpful to you.