1

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.

I've learnt that it's possible to do a similar thing with hooks, so I transferred all of the edits to multiple hooks. Now the issue is that I need to load my newly created DLL before anything else which means using a different method other than simply injecting it.

I hope this makes sense, what would be the best method to achieve this?

  • Hi and welcome to RE.SE. How is it different than simply injecting? One method of injecting a DLL is to create a process yourself, which means you typically have all required rights to do whatever you like with it. Combine that with starting said process suspended and you have a recipe for injecting DLLs before the main entry point of the executable gets to run ... what am I missing? (duh, only saw the answer after I commented ... that answer embodies all I described) – 0xC0000022L Mar 31 at 19:56
3

You could create a loader which simply creates your target app in suspended state and loads dll into virtual address space of that process. That way the dll you injected would run before entrypoint of the target app. Example code:

STARTUPINFO si;
PROCESS_INFORMATION pi;
ZeroMemory(&si, sizeof(STARTUPINFO));
ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
si.cb = sizeof(STARTUPINFO);
LPCSTR dllname = "testdll.dll";
LPVOID stringAddr = NULL;
LPVOID LoadLib = NULL;

LoadLib = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
if (LoadLib == NULL) {
    return -1;
}

if (!CreateProcess(TEXT("target.exe"), NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
    return -1;
}

stringAddr = VirtualAllocEx(pi.hProcess, NULL, strlen(dllname), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (stringAddr == NULL) {
    return -1;
}

WriteProcessMemory(pi.hProcess, stringAddr, dllname, strlen(dllname), NULL);
CreateRemoteThread(pi.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLib, stringAddr, NULL, NULL);
ResumeThread(pi.hThread);
WaitForSingleObject(pi.hProcess, INFINITE);

CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
return 0;
2

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE.

From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify: enter image description here

Then click Directories: enter image description here

Click the Ellipsis button next to Import Table: enter image description here

Right Click and choose add import: enter image description here

Now add your dll and an export from the DLL: enter image description here

Press OK and then SAVE. Although not required you can correct the PE checksum with the ? button (and save afterwards): enter image description here

Note that adding the import doesn't mean that the executable loading your dll calls the export specified. It just means that the dll will be loaded and it's DLLMain will be called.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.