3

I have an address that is located in a dll loaded by my target process. I would like to call this address using dll injection.

For now my dll looks like this:

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
        case DLL_PROCESS_ATTACH:
        {
            MessageBox(NULL, L"Injection Successful", L"TEST:", MB_OK); 
            //Here I'd like to call the address

            break;
        }
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

From what I've learned online, there are some problems:

  • I can't use the address that is shown in the debugger (x64dbg) because of some offset stuff I don't understand.
  • The address is a different one every time I start the program.

I'm using Cheat Engine to inject the dll and x64dbg as a debugger. Since I'm a beginner, a bit of code would be very much appreciated.

1
  • Doing such stunts from DllMain can be a patently bad idea. Certain locking conditions apply inside DllMain. Grab a decent book and read up on it. Perform only simple actions inside DllMain, perhaps set an event or output a debug string (which you can see in WinDbg or DbgView).
    – 0xC0000022L
    Aug 23, 2019 at 20:04

1 Answer 1

1

There are plenty of ways to do what you want.

  1. I recommend you to export the method you want to call and then use the GetProcAddress function to get the address of it and call it. You can use the code sample from the MSDN; it should work as is in your case.
  2. You can get the loading address of your DLL: see StackOverflow post. You need to calculate the offset to your function and add that to the loading address.
  3. You can get the current address of your code with some assembly code. See the StackOverflow post for instance. Again, you need to calculate the offset to the function you want to call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.