Permanently load a DLL to an executable

Question

With the help of IDA I was able to hard-code changes into an executable by simply replacing some bytes with a hex editor, what I did was to change the resolution to something larger.

I've learnt that it's possible to do a similar thing with hooks, so I transferred all of the edits to multiple hooks. Now the issue is that I need to load my newly created DLL before anything else which means using a different method other than simply injecting it.

I hope this makes sense, what would be the best method to achieve this?

Answer 1

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE.

From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify:

Then click Directories:

Click the Ellipsis button next to Import Table:

Right Click and choose add import:

Now add your dll and an export from the DLL:

Press OK and then SAVE. Although not required you can correct the PE checksum with the ? button (and save afterwards):

Note that adding the import doesn't mean that the executable loading your dll calls the export specified. It just means that the dll will be loaded and it's DLLMain will be called.

Answer 2

You could create a loader which simply creates your target app in suspended state and loads dll into virtual address space of that process. That way the dll you injected would run before entrypoint of the target app. Example code:

STARTUPINFO si;
PROCESS_INFORMATION pi;
ZeroMemory(&si, sizeof(STARTUPINFO));
ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
si.cb = sizeof(STARTUPINFO);
LPCSTR dllname = "testdll.dll";
LPVOID stringAddr = NULL;
LPVOID LoadLib = NULL;

LoadLib = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
if (LoadLib == NULL) {
    return -1;
}

if (!CreateProcess(TEXT("target.exe"), NULL, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
    return -1;
}

stringAddr = VirtualAllocEx(pi.hProcess, NULL, strlen(dllname), MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (stringAddr == NULL) {
    return -1;
}

WriteProcessMemory(pi.hProcess, stringAddr, dllname, strlen(dllname), NULL);
CreateRemoteThread(pi.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLib, stringAddr, NULL, NULL);
ResumeThread(pi.hThread);
WaitForSingleObject(pi.hProcess, INFINITE);

CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
return 0;